Overview

overview

10

Static

static

10

2024-06-14...ma.exe

windows7-x64

10

2024-06-14...ma.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 19:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-14_ff31faf94d4c9a95810c4016feac1590_crysis_dharma.exe

  • Size

    92KB

  • MD5

    ff31faf94d4c9a95810c4016feac1590

  • SHA1

    4ffa58e8d74452723ca6fe3e48a97232dac66957

  • SHA256

    69f5f2dd402929bc22dea2cdb6e6bd962c6d2f8aaede722a111230056783e547

  • SHA512

    201df1a2aaaa0d6fcfa13e58c1928fcbca32012ac82f38c83de79651c293d2b7c4a1db81d532d11cb98a5933f791dd056d88788d0287ba4880cfe07aeb3029c7

  • SSDEEP

    1536:GBwl+KXpsqN5vlwWYyhZ9S4AlD6/jvDSFnFEOXRl:ww+asqN5aW/hSDD6bvOFFEOB

Score
10/10
dharmadefense_evasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (515) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-14_ff31faf94d4c9a95810c4016feac1590_crysis_dharma.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-14_ff31faf94d4c9a95810c4016feac1590_crysis_dharma.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:3360
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:1028
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:9300
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:5520
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:4048
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
            PID:7648
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:3244
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3020

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-47906DB1.[[email protected]].rxx
            Filesize

            2.7MB

            MD5

            aef8653d56ac337e1ee85f88132b7b72

            SHA1

            541ab9a5edea4effa9546b90392414e1e2b6f09c

            SHA256

            28a1110cf8d5cab626f70f55f2d25278ef3ec05199bb6e424651836eee5072f4

            SHA512

            8257dc104a63b87bef99624b6525c22cfb6d96422038df90e4d59aa8940bec687e89ff7b0c315d59a165081d9f4183042448611d46f08d976d06061163f2465f

            Download Submit

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
            Filesize

            7KB

            MD5

            b64e24b9341b2528519a6a98051a314c

            SHA1

            9f5e6e0187fc127742aff9864adbb53ce78db693

            SHA256

            e803597ee52f3678c94c58ea524a5b680defa345cca7f5369fb70d34690dda47

            SHA512

            bfd69e0660c6001c247a1a89f5971a2da03077f3ce82dd3145cfd59f9de6566cb50b2721e99aac7b83aa06767dded75221838083f7fe1f76530f79c0dba2a05c

            Download Submit