Overview

overview

10

Static

static

3

VirusShare...d2.exe

windows7-x64

10

VirusShare...d2.exe

windows10-2004-x64

10

Resubmissions

12-05-2023 13:34

230512-qvjbpadc48 10

08-05-2023 17:48

230508-wdvw2sdf6v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VirusShare_5c36e305d926e55ef98d392176890cd2

  • Size

    1.0MB

  • Sample

    230508-wdvw2sdf6v

  • MD5

    5c36e305d926e55ef98d392176890cd2

  • SHA1

    64a15cdf89b6c8b85cba355b6944074614d810fd

  • SHA256

    5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

  • SHA512

    082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

  • SSDEEP

    24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

Score
10/10
dharmadiscoveryevasionransomware

Malware Config

Targets

    • Target

      VirusShare_5c36e305d926e55ef98d392176890cd2

    • Size

      1.0MB

    • MD5

      5c36e305d926e55ef98d392176890cd2

    • SHA1

      64a15cdf89b6c8b85cba355b6944074614d810fd

    • SHA256

      5671112c276673ee5c4630994ac0034927cee2aa05a32ca6950edbc80c56e7e8

    • SHA512

      082855fadbe445ab1f582bb7773276c08bded82ecd00ae1651b620aa12e97315d01acea3cfbe99c504d6d74ce1cff471a4993ff8ebb93416df787cefa88baf1b

    • SSDEEP

      24576:EoZZV7Uqi5inyhZQDkUzVDZJ2vH53GaJR38:HOqigyDQDZVq52wM

    Score
    10/10
    dharmadiscoveryevasionransomware

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

      ransomwaredharma

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Disables taskbar notifications via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Drops startup file

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Hidden Files and Directories

1
T1158

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Indicator Removal on Host

1
T1070

File Deletion

3
T1107

File Permissions Modification

1
T1222

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

5
T1490

Tasks