Overview

overview

10

Static

static

3

VirusShare...d2.exe

windows7-x64

10

VirusShare...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_5c36e305d926e55ef98d392176890cd2.exe

  • Size

    1.0MB

  • Sample

    230507-dwbl1sbg3w

  • MD5

    5c36e305d926e55ef98d392176890cd2

  • SHA1

    64a15cdf89b6c8b85cba355b6944074614d810fd

  • SHA256

    5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

  • SHA512

    082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

  • SSDEEP

    24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

Score
10/10
dharmadiscoveryevasionransomware

Malware Config

Targets

    • Target

      VirusShare_5c36e305d926e55ef98d392176890cd2.exe

    • Size

      1.0MB

    • MD5

      5c36e305d926e55ef98d392176890cd2

    • SHA1

      64a15cdf89b6c8b85cba355b6944074614d810fd

    • SHA256

      5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

    • SHA512

      082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

    • SSDEEP

      24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

    Score
    10/10
    dharmadiscoveryevasionransomware

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Disables Task Manager via registry modification

      evasion

    • Drops startup file

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Hidden Files and Directories

1
T1158

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Permissions Modification

1
T1222

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks