Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-11-2024 23:52
General
-
Target
Rack/e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe
-
Size
300KB
-
MD5
26bf7c2ab048094e9a0c15368d1105ba
-
SHA1
b0946dd6abcab1fddc71e2308ffb4587e094b03d
-
SHA256
e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d
-
SHA512
437746ac926442d99cd9fa1164749a7a798be780e21ef42d14b4cb55ff8109eae296da5d74df924bc78c8ce2dc78b867dde032c297461dbebb4df2f728e6148f
-
SSDEEP
6144:T6ckSlQncoC4x/B5eRc6w/QPgDEC0NpW6AvJF55yFW6:T6RPncohxf/YqECCzMRm
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 5 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rack\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe"C:\Users\Admin\AppData\Local\Temp\Rack\e98b1768aa5636c335985669c52319f9226089f9298dd5f9840c062bf8dcd18d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.5MB
MD517c2bf6bd32b0c4c1ca7e5e30026eb8f
SHA12cec4de6785f8f98ef20491d857caac8a3b46c1a
SHA25691628502fb3c43e17e4c851ab0984f107af27f3d5d47e706bd724c61c7ccb94d
SHA512d9abe4f6a994b290ff68b870ad0049332ffcb1f3effe38a10d4f045dc5e3fec6a1916d1bbe34ae3e2055dbab2d0c8321344c218989916cb621f17b06fe09f475
-
Filesize
13KB
MD58b07add192989d0de0a67afa484bd723
SHA12346c6d284a90a08224422e9bf0ce00cd3e7159f
SHA25682c51843bf49f2d3dd7cad5f0f97c12d72e973515968fa1a74f0924dcc99dd6a
SHA512879ba200169c6ffe59da965bb1428a65d0159b374c3305598844bbbea77ca6d494f2f21a4716c6b79842fd3c2885c2bd245eabe529c6f62e8cb8193fcdf87d64
-
Filesize
64KB
-
Filesize
100KB
-
Filesize
1024KB
-
Filesize
100KB
-
Filesize
1024KB
-
Filesize
100KB
-
Filesize
2.0MB