dharma | dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

General

Target

CoronaVirus.exe
Size

1.0MB
MD5

055d1462f66a350d9886542d4d79bc2b
SHA1

f1086d2f667d807dbb1aa362a7a809ea119f2565
SHA256

dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
SHA512

2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
SSDEEP

24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2

Score

10^/10

dharma defense_evasion execution impact persistence ransomware

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Drops startup file 1 IoCs

Processes:

CoronaVirus.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe CoronaVirus.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

CoronaVirus.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe

Drops desktop.ini file(s) 3 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	CoronaVirus.exe

Drops file in System32 directory 1 IoCs

Processes:

CoronaVirus.exe

description ioc process

File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe

description	ioc	process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

Processes:

CoronaVirus.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll	CoronaVirus.exe
File created	C:\Program Files\7-Zip\7-zip.chm.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	CoronaVirus.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll	CoronaVirus.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	CoronaVirus.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt.id-15D36FFA.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	CoronaVirus.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2452 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

CoronaVirus.exe

pid process

840 CoronaVirus.exe
840 CoronaVirus.exe
840 CoronaVirus.exe
840 CoronaVirus.exe

pid	process
2452	vssadmin.exe

pid	process
840	CoronaVirus.exe
840	CoronaVirus.exe
840	CoronaVirus.exe
840	CoronaVirus.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

CoronaVirus.execmd.exe

description	pid	process	target process
PID 840 wrote to memory of 2560	840	CoronaVirus.exe	cmd.exe
PID 840 wrote to memory of 2560	840	CoronaVirus.exe	cmd.exe
PID 840 wrote to memory of 2560	840	CoronaVirus.exe	cmd.exe
PID 840 wrote to memory of 2560	840	CoronaVirus.exe	cmd.exe
PID 2560 wrote to memory of 2352	2560	cmd.exe	mode.com
PID 2560 wrote to memory of 2352	2560	cmd.exe	mode.com
PID 2560 wrote to memory of 2352	2560	cmd.exe	mode.com
PID 2560 wrote to memory of 2452	2560	cmd.exe	vssadmin.exe
PID 2560 wrote to memory of 2452	2560	cmd.exe	vssadmin.exe
PID 2560 wrote to memory of 2452	2560	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe
"C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\system32\mode.com
mode con cp select=1251
3⤵
PID:2352

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2452

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1916

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-15D36FFA.[[email protected]].ncov
Filesize
15.9MB

MD5
475195caddd02866b4a9d7b5a3e8c7c3

SHA1
2cbdac62b673869479c4ce1962f4db9df9bfa506

SHA256
651098010b21015e6342c7df44a944173bcfdade9eb573091a36cbfe3ad8721a

SHA512
488ad18e5902c0a6d602db4bbfad97cfc1a7dd22a48a63a0a763d23d24dffbe106ab22dfeb1e0e73545fe57e715cc33e80287cf56d063dacfaccb3d1b91c6c4f

Download Submit
memory/840-0-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/840-1-0x000000000A8C0000-0x000000000A8F4000-memory.dmp

Filesize
208KB

Download
memory/840-2-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/840-837-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/840-4777-0x000000000A8C0000-0x000000000A8F4000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads