Overview

overview

10

Static

static

3

VirusShare...d2.exe

windows7-x64

10

VirusShare...d2.exe

windows10-2004-x64

10

Resubmissions

12-05-2023 13:34

230512-qvjbpadc48 10

08-05-2023 17:48

230508-wdvw2sdf6v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_5c36e305d926e55ef98d392176890cd2

  • Size

    1.0MB

  • Sample

    230508-wdvw2sdf6v

  • MD5

    5c36e305d926e55ef98d392176890cd2

  • SHA1

    64a15cdf89b6c8b85cba355b6944074614d810fd

  • SHA256

    5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

  • SHA512

    082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

  • SSDEEP

    24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

Score
10/10
dharmadiscoveryevasionransomware

Malware Config

Targets

    • Target

      VirusShare_5c36e305d926e55ef98d392176890cd2

    • Size

      1.0MB

    • MD5

      5c36e305d926e55ef98d392176890cd2

    • SHA1

      64a15cdf89b6c8b85cba355b6944074614d810fd

    • SHA256

      5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

    • SHA512

      082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

    • SSDEEP

      24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

    Score
    10/10
    dharmadiscoveryevasionransomware

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Disables taskbar notifications via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Drops startup file

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks