Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2024 17:00

General

  • Target

    suck my dik niger.exe

  • Size

    92KB

  • MD5

    c2ec717719cc20e4527e5a4b43e48eb5

  • SHA1

    9f6bac7a8ab1a95922aa0a19b8b99b5dd60ac916

  • SHA256

    a1f3a173379286a85de310dc648c9040453571b130c63528f7856d1c3c8f0142

  • SHA512

    400caf22baa9c249055e876d4751ec010ee2f1e45b07c922a12304b4965e9032b2553f33c59c7885bbdd8cc6ab55c19f80c15e16f3e0526d974630b47cfd9ec2

  • SSDEEP

    1536:mBwl+KXpsqN5vlwWYyhY9S4AnOgzSn7V84yIHAM/PatiR52gIlJ:Qw+asqN5aW/hLR7z0iIgqaK5

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 0E392D11 In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

  • Dharma family
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Renames multiple (321) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 5 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\suck my dik niger.exe
    "C:\Users\Admin\AppData\Local\Temp\suck my dik niger.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:1756
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2148
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:2436
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:4664
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:4652
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:3108
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3468
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding 85C0DBAAC4275F12C73206E917532CA3
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2752
        • C:\Windows\system32\MsiExec.exe
          C:\Windows\system32\MsiExec.exe -Embedding 5CD0C927715774DB152438E918995EE5
          2⤵
          • Loads dropped DLL
          PID:2188

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-0E392D11.[[email protected]].gamma

        Filesize

        23.5MB

        MD5

        ef4c1c4b00e3f48e1d2168d917abf2b1

        SHA1

        e15026f53981c939d603d04d33e45bbf2b65658d

        SHA256

        346b92bf7bd072320bf08d48de7638c7a9beab4b21651b2c14b43a7bdae019ec

        SHA512

        2fbb757a92bbd6af913d54ff007a4cde6af2a0b0676ad2863ad57fc64b5e8daed379da67f85db7c45122f056aa59aa74165697e48db9db9c31eb756670ae2bdf

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

        Filesize

        13KB

        MD5

        cb430519d1b31a000f8cf37e6f1cbcbf

        SHA1

        63e74fd3bb70ff4eac88e878717bacdbc3844dc8

        SHA256

        128dbdd6309d9c1e54648a89df3d24d2dcbd31a3087eb12221958d5bc0fb2bda

        SHA512

        7971a764ee3bc2c328e61f8fed90a56f753e8bec87927a1d060d1d0e9b844d105a325e04607333daafd3965075292bf2230ea2962ccf664851fb1ee4cc2606f1

      • C:\Windows\Installer\MSI2A8.tmp

        Filesize

        86KB

        MD5

        ff58cd07bf4913ef899efd2dfb112553

        SHA1

        f14c1681de808543071602f17a6299f8b4ba2ae8

        SHA256

        1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

        SHA512

        23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

      • C:\Windows\Installer\MSIF75A.tmp

        Filesize

        257KB

        MD5

        d1f5ce6b23351677e54a245f46a9f8d2

        SHA1

        0d5c6749401248284767f16df92b726e727718ca

        SHA256

        57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

        SHA512

        960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

      • C:\Windows\Installer\MSIFF4C.tmp

        Filesize

        148KB

        MD5

        33908aa43ac0aaabc06a58d51b1c2cca

        SHA1

        0a0d1ce3435abe2eed635481bac69e1999031291

        SHA256

        4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

        SHA512

        d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

      • \Windows\Installer\MSIF845.tmp

        Filesize

        363KB

        MD5

        4a843a97ae51c310b573a02ffd2a0e8e

        SHA1

        063fa914ccb07249123c0d5f4595935487635b20

        SHA256

        727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

        SHA512

        905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

      • \Windows\Installer\MSIFD47.tmp

        Filesize

        28KB

        MD5

        85221b3bcba8dbe4b4a46581aa49f760

        SHA1

        746645c92594bfc739f77812d67cfd85f4b92474

        SHA256

        f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

        SHA512

        060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

      • memory/4652-20258-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

        Filesize

        64KB