Extracted

• • Target

    b231263f-0b92-4f02-9e71-3d6a05534490.jpg

  • Size

    26KB

  • MD5

    99cfb36285d82796d745c8a199f6acff

  • SHA1

    ab990d5b00d7878178a6e77553152149ce4f56c3

  • SHA256

    afc3ff71d364c14eecc12918e7c00a435943005fc86dafa53da529f0a9c95285

  • SHA512

    3a9558a9e628aac5af58f98a9e7056fe5a2741517067f0f9ebac9a800d6bd564433ab0b3910746f99e82573d2ba176241ce3d3b25961a6c27ae828c0d4defd26

  • SSDEEP

    768:Z3Bt4w6U03dxH1/ARsjefQIbwTj5pW0JPfmXkD+lakhXOsX0:Z3BtNZAdxHdARkef7bQ5I8POEqY

  Score

  10^/10

  dharmagandcrabbackdoorcredential_accessdefense_evasiondiscoveryexecutionimpactlateral_movementpersistenceprivilege_escalationransomwarespywarestealer

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma

  • Dharma family

    dharma

  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab

  • Gandcrab family

    gandcrab

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Renames multiple (113) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Password Policy Discovery

    Attempt to access detailed information about the password policy used within an enterprise network.

    discovery

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion
  behavioral1