General
-
Target
2024-09-05_f25b8c72c61c734bbf4ee7cbffda3d48_crysis_dharma
-
Size
92KB
-
Sample
240905-rtkzkasflq
-
MD5
f25b8c72c61c734bbf4ee7cbffda3d48
-
SHA1
5b725dbebfd73c95067cc40c904dd981a5f1ce22
-
SHA256
ce371f9f9c2446ca5d84e5df4bd8562247c198310b81e577fa4afc2398795438
-
SHA512
e63183995e9e3950790266f71130fcabe3d4e9d7e270b1f72116323e16f31a6f51a4d96d268dbc1fdc3ad2375ad20e7dc0b1572a5a7bedb54209afc3dcb7d8d8
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A5qERXCE5uodtYr2I41:Qw+asqN5aW/hLn9Ry6bC2f1
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_f25b8c72c61c734bbf4ee7cbffda3d48_crysis_dharma.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_f25b8c72c61c734bbf4ee7cbffda3d48_crysis_dharma.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Targets
-
-
Target
2024-09-05_f25b8c72c61c734bbf4ee7cbffda3d48_crysis_dharma
-
Size
92KB
-
MD5
f25b8c72c61c734bbf4ee7cbffda3d48
-
SHA1
5b725dbebfd73c95067cc40c904dd981a5f1ce22
-
SHA256
ce371f9f9c2446ca5d84e5df4bd8562247c198310b81e577fa4afc2398795438
-
SHA512
e63183995e9e3950790266f71130fcabe3d4e9d7e270b1f72116323e16f31a6f51a4d96d268dbc1fdc3ad2375ad20e7dc0b1572a5a7bedb54209afc3dcb7d8d8
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A5qERXCE5uodtYr2I41:Qw+asqN5aW/hLn9Ry6bC2f1
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1