Overview

overview

10

Static

static

3

CoronaVirus.exe

windows7-x64

CoronaVirus.exe

windows10-2004-x64

Resubmissions

30-06-2024 01:19

240630-bpptys1fka 10

29-06-2024 23:34

240629-3kgrbszama 10

Analysis

  • max time kernel
    116s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    30-06-2024 01:19

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    CoronaVirus.exe

  • Size

    1.0MB

  • MD5

    055d1462f66a350d9886542d4d79bc2b

  • SHA1

    f1086d2f667d807dbb1aa362a7a809ea119f2565

  • SHA256

    dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

  • SHA512

    2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

  • SSDEEP

    24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2

Score
10/10
dharmadefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message B68BA828 In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (311) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe
    "C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2436
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2536
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2776
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:2020
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2224
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          PID:208
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          PID:204
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2456
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:2280
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1752
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2780
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:472068 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2836
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x0
          1⤵
            PID:1012
          • C:\Windows\system32\AUDIODG.EXE
            C:\Windows\system32\AUDIODG.EXE 0x560
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2896
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x1
            1⤵
              PID:2640

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-B68BA828.[[email protected]].ncov
              Filesize

              23.5MB

              MD5

              189f1ae6f14ad16d9d86212e2b65a56c

              SHA1

              45e0d2ee56034f22539e8a62eab757b22f836792

              SHA256

              f392eec634ea8fbdb743feddea1f675ee71286a77ec2293cca10e10981815c3d

              SHA512

              6803a7526557ce014e0b2816f4a380360b7ad1f7f783b67ac6ee978a0614dbecf482d52c5c45276b20238b2781374e1c2eb9512e93095ef31f0ee7affc448842

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
              Filesize

              1KB

              MD5

              a266bb7dcc38a562631361bbf61dd11b

              SHA1

              3b1efd3a66ea28b16697394703a72ca340a05bd5

              SHA256

              df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

              SHA512

              0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              c2b0511d010e24d33b898ead2e48b4e8

              SHA1

              4650f38f0a42cf5e214713b3f40db1b4a30b2e32

              SHA256

              2b6902c12a3855008aa85d095932fbd01b313681e23caca9515315e3b2d133dc

              SHA512

              7cb3f1b8bf5220faaddcd27eb5b3e7b35a5fcb7bda9c883074ac1315f9ef2867431cc8dc1149c9e80731a6057c90a4a94ce99caab716708cb19056c28b130691

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              f2610ac4af98b44b3a854a69c78b899d

              SHA1

              cee568e039c23070f97aa898b592eb473a4d537a

              SHA256

              9dd8a6560aca8a296c75284c9af4f77af13268bdcba327e94538489f6afe7c6f

              SHA512

              bd709c10b13c7daf9527c8c10825ea7717cfabeaa92c0c5c5661d7949ad441b1674f5de4ebf14a4ec47c2726497550f7292c6ce71479f777d11344cf49b0f68c

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              c1c7019eeb95f7eb45ea26ea228f8840

              SHA1

              a4d255c94ecc87c1dea07af733c91c56e5896980

              SHA256

              8f14fcc2674cbe56896ddcfd1540c219161168b4bf7d45bb92a99da55a360028

              SHA512

              647278ef2f8c899f55a3a8f13713538c31cf4a4567e6280570390afa0a93dd4e2806b1c6fb0f9c1629e329bc559b97fa7f723cae5fac741da919ae4205b38015

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              30636861cd4105a298cb0bd23a60ac14

              SHA1

              10a0b97131a57a995ac45d04a3e1b3fd25668440

              SHA256

              58ce3dc9dea7e4bce0edc316bf02bab1fd27b00c5fbd296e930b4f23a4c28d7d

              SHA512

              5309223b5056f867aae77edd21e8d3cb36b696d2933f4b84e7f638dea1fb9542650ffd744e9bf60292401e8b015ee20de77dbab5092e2ff1880b66292d135d75

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              c18ff0838b371ad9cdad8be42d0acebe

              SHA1

              aa2bb4d90c8b849fc848cc142214d0f1d9c3e9d2

              SHA256

              ee2bac9a48528d364e8ac6da3bca5eb01b6779818d37d4a48d135c7c5e30f8d7

              SHA512

              d5b99b2f0477120da36a75b49e5f864b6f84bd4bf7ec2ba29527bdbf9ee39c439dda168a1922ba28408e66b5285744e96344a2bacf09cc9deb9b49114a432871

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              342B

              MD5

              b45339f00b8faa24d0562fcc83deb8bd

              SHA1

              a10492c46783f9d5dba742572e9af1ed28ffce46

              SHA256

              2cd8b8cb7cdd207e6d02b7c4544b91a084570daa6728d86a80e89c147fa9bcbb

              SHA512

              1446e0b4f07a420ca4e942b64ef298bc28a977bf077cd874523ca4602765cd7ba3c6f261fdec5871497c18f08746af94d45a5e219f201bf1a10cf28626cab429

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
              Filesize

              242B

              MD5

              52e16e10cc8726c4083133707b492642

              SHA1

              d47d6d64baf169f2e1904f992ff20eaa32bfb45d

              SHA256

              6232fe3581917d4286b46bc60e6fcfb7332d1f0db4c09cacc7b4ec3940681ca5

              SHA512

              f6c37bfa22dc2d295d213f1fdf7c3dc32b448d1e29267a77bd69c19a511eb9cc13355d25db0c29d3d760a1e8aa3651a49cc8419194e6c02b26d0605730c44e74

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Cab6F85.tmp
              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Tar7055.tmp
              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\1PH8ZRML.txt
              Filesize

              194B

              MD5

              66c13fa004dd620c6c2107d2c4d5db34

              SHA1

              68783a547e36634018d72d7d060e99b2865527cf

              SHA256

              6f2d7e7ea72842e9532492f9bc7c9a1dd9a5b28086360706de267df63c12e7f4

              SHA512

              d91ff7c320a7f4f4d210af20285403d5734ffb4ac61f66b993d8ce1d70c789ba182af1fc7b139a4c70eb67fb306e93c441a26119335edb6104a3afae118e88e2

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
              Filesize

              13KB

              MD5

              e7b2de9306b0fd342b9f000f99cc32c7

              SHA1

              b595b5f127ee6716d57dd09cf9613d1f82f3ad9d

              SHA256

              46bb57b6cb73cca88349aefb4b4d25b6c08191345e59c23809e3194761e9b00f

              SHA512

              4b8169dfbf8615a5905bc2581649c2c1f659eee269187336e91f5084947b7ce145453be3003d26b30186ff519678e779b4a379c972215285fa473d00f1b848e5

              Download Submit

            • memory/204-20224-0x0000000002A30000-0x0000000002A40000-memory.dmp

              Filesize

              64KB

              Download

            • memory/204-20222-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

              Filesize

              64KB

              Download

            • memory/208-20190-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2728-0-0x0000000000400000-0x000000000056F000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/2728-10476-0x000000000ACA0000-0x000000000ACD4000-memory.dmp

              Filesize

              208KB

              Download

            • memory/2728-229-0x0000000000400000-0x000000000056F000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/2728-2-0x0000000000400000-0x000000000056F000-memory.dmp

              Filesize

              1.4MB

              Download

            • memory/2728-1-0x000000000ACA0000-0x000000000ACD4000-memory.dmp

              Filesize

              208KB

              Download