Overview

overview

10

Static

static

3

aaa/CoronaVirus.exe

windows7-x64

10

aaa/GoldenEye.exe

windows7-x64

10

aaa/MEMZ.exe

windows7-x64

6

aaa/Winloc...od.exe

windows7-x64

10

Analysis

  • max time kernel
    42s
  • max time network
    27s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    04-08-2024 17:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aaa/CoronaVirus.exe

  • Size

    1.0MB

  • MD5

    055d1462f66a350d9886542d4d79bc2b

  • SHA1

    f1086d2f667d807dbb1aa362a7a809ea119f2565

  • SHA256

    dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

  • SHA512

    2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

  • SSDEEP

    24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2

Score
10/10
dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 7D4837C7 In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (287) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 14 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaa\CoronaVirus.exe
    "C:\Users\Admin\AppData\Local\Temp\aaa\CoronaVirus.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:2796
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2208
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
          PID:4732
          • C:\Windows\system32\mode.com
            mode con cp select=1251
            3⤵
              PID:4808
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              3⤵
              • Interacts with shadow copies
              PID:4820
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
            2⤵
              PID:4840
            • C:\Windows\System32\mshta.exe
              "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
              2⤵
                PID:4868
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:840
            • C:\Windows\system32\msiexec.exe
              C:\Windows\system32\msiexec.exe /V
              1⤵
              • Enumerates connected drives
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2240
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 150FA8AAD0AD29F5DC295155813C9986
                2⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1992
              • C:\Windows\system32\MsiExec.exe
                C:\Windows\system32\MsiExec.exe -Embedding DB857DC185E9277420A731B6F8458949
                2⤵
                  PID:5052

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Windows Management Instrumentation

              1
              T1047

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Direct Volume Access

              1
              T1006

              Indicator Removal

              2
              T1070

              File Deletion

              2
              T1070.004

              Modify Registry

              1
              T1112

              Credential Access

              Credentials from Password Stores

              2
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Windows Credential Manager

              1
              T1555.004

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Browser Information Discovery

              1
              T1217

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              1
              T1012

              System Information Discovery

              1
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Inhibit System Recovery

              2
              T1490

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-7D4837C7.[[email protected]].ncov
                Filesize

                6.3MB

                MD5

                d0f7f73ae40cf7c23f27538fbdcdd92d

                SHA1

                c98434807c5fd5d89c47a0d5baca5a7cdb9e86f0

                SHA256

                25941be33d31f1be0631ec374b89266507b9ff2a1bf7ee45adebf6ecf1eeddc6

                SHA512

                640074a9eb19022ffaeea43ea11a49117e44d8dff82ca89ee313737243ea7ec8cd1f5590ed3dc62e7eb06957601ffd1949baaf87018220429cda4a2fd695fa58

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
                Filesize

                13KB

                MD5

                7be30d734e4ec8825310823f68312c2c

                SHA1

                e07b5797fbacb246e14200da6b6f5e5e8ed9ff60

                SHA256

                c02d88e4cbf0a7f65e276a6ab39651a67f7fe35d7393627c622044ae3342b84e

                SHA512

                12e716d7f341a4b3cf2adf36e5f4b5229cecd013279aa98f99c294b1d388906fe07567a1d1f9c96a591aa5fbc41f84cf333e1194a86526c7831b18a968309ea4

                Download Submit

              • C:\Windows\Installer\MSIE7A1.tmp
                Filesize

                257KB

                MD5

                d1f5ce6b23351677e54a245f46a9f8d2

                SHA1

                0d5c6749401248284767f16df92b726e727718ca

                SHA256

                57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

                SHA512

                960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

                Download Submit

              • C:\Windows\Installer\MSIED7D.tmp
                Filesize

                28KB

                MD5

                85221b3bcba8dbe4b4a46581aa49f760

                SHA1

                746645c92594bfc739f77812d67cfd85f4b92474

                SHA256

                f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

                SHA512

                060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

                Download Submit

              • C:\Windows\Installer\MSIF204.tmp
                Filesize

                86KB

                MD5

                ff58cd07bf4913ef899efd2dfb112553

                SHA1

                f14c1681de808543071602f17a6299f8b4ba2ae8

                SHA256

                1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391

                SHA512

                23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

                Download Submit

              • \Windows\Installer\MSIE947.tmp
                Filesize

                363KB

                MD5

                4a843a97ae51c310b573a02ffd2a0e8e

                SHA1

                063fa914ccb07249123c0d5f4595935487635b20

                SHA256

                727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

                SHA512

                905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

                Download Submit

              • \Windows\Installer\MSIEE5A.tmp
                Filesize

                148KB

                MD5

                33908aa43ac0aaabc06a58d51b1c2cca

                SHA1

                0a0d1ce3435abe2eed635481bac69e1999031291

                SHA256

                4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

                SHA512

                d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

                Download Submit

              • memory/3040-2-0x0000000000400000-0x000000000056F000-memory.dmp

                Filesize

                1.4MB

                Download

              • memory/3040-5578-0x0000000000400000-0x000000000056F000-memory.dmp

                Filesize

                1.4MB

                Download

              • memory/3040-17554-0x000000000ACA0000-0x000000000ACD4000-memory.dmp

                Filesize

                208KB

                Download

              • memory/3040-0-0x0000000000400000-0x000000000056F000-memory.dmp

                Filesize

                1.4MB

                Download

              • memory/3040-1-0x000000000ACA0000-0x000000000ACD4000-memory.dmp

                Filesize

                208KB

                Download

              • memory/4868-20316-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

                Filesize

                64KB

                Download