Extracted

• • Target

    Screenshot 2024-07-17 170406.png

  • Size

    197KB

  • MD5

    7bfa0d3ebbb2a47e61b4d0a96f89a198

  • SHA1

    d8eb75bb078f7868c9fd070a4f455e27f101170a

  • SHA256

    34ff5e904a3dc6268af261b04fb43440bc329e5ecf7219eaaf59ccbd82501701

  • SHA512

    a5d39664831b1598855bcf905d763ef73cfdeb57742d31d9fa360eae4a7e949ee69feb404725672a7d2683fbe5e1b43827fc61b88ead64590bb0dcf7bbd70ee7

  • SSDEEP

    6144:CvxkMyQexd18lY2d70Jc8bLy7oQBH3HyqmjYVVT:UVyQezKf7qPy7f93SqmOT

  Score

  10^/10

  dharmawannacrydefense_evasionexecutionimpactpersistenceransomwarespywarestealerworm

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (318) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1