General
-
Target
2024-07-01_511738859da1bb1e49d6391927d63783_crysis_dharma
-
Size
92KB
-
Sample
240701-qpfnlstfnd
-
MD5
511738859da1bb1e49d6391927d63783
-
SHA1
fe7ac5b4d0372b513c13f2c8f23b0a59019773bf
-
SHA256
20ce14d53c4c1018a9c3a9fe6bffa498cfbf437b6c332c65354a84c876732fdf
-
SHA512
bd67af55703f3c71a92947602ce9e5989b856bd8c59952bc70c784c39dbf5d62a0586895ac047d5bde3f90b7f6a3d6de043d3d60898b69b558e60ba36fc821fb
-
SSDEEP
1536:0Bwl+KXpsqN5vlwWYyh69S4AnT2TtLjXZ67McsRmaBNSaHRl63:ew+asqN5aW/h5RgjXZ675aBNBO
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_511738859da1bb1e49d6391927d63783_crysis_dharma.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-07-01_511738859da1bb1e49d6391927d63783_crysis_dharma.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Targets
-
-
Target
2024-07-01_511738859da1bb1e49d6391927d63783_crysis_dharma
-
Size
92KB
-
MD5
511738859da1bb1e49d6391927d63783
-
SHA1
fe7ac5b4d0372b513c13f2c8f23b0a59019773bf
-
SHA256
20ce14d53c4c1018a9c3a9fe6bffa498cfbf437b6c332c65354a84c876732fdf
-
SHA512
bd67af55703f3c71a92947602ce9e5989b856bd8c59952bc70c784c39dbf5d62a0586895ac047d5bde3f90b7f6a3d6de043d3d60898b69b558e60ba36fc821fb
-
SSDEEP
1536:0Bwl+KXpsqN5vlwWYyh69S4AnT2TtLjXZ67McsRmaBNSaHRl63:ew+asqN5aW/h5RgjXZ675aBNBO
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-