Overview

overview

10

Static

static

3

CoronaVirus.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2025, 20:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CoronaVirus.exe

  • Size

    1.0MB

  • MD5

    055d1462f66a350d9886542d4d79bc2b

  • SHA1

    f1086d2f667d807dbb1aa362a7a809ea119f2565

  • SHA256

    dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

  • SHA512

    2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

  • SSDEEP

    24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2

Score
10/10
dharmacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 3444597F In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (513) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe
    "C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3804
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
        PID:392
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:27100
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:19568
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          2⤵
            PID:19796
            • C:\Windows\system32\mode.com
              mode con cp select=1251
              3⤵
                PID:12020
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                3⤵
                • Interacts with shadow copies
                PID:19152
            • C:\Windows\System32\mshta.exe
              "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
              2⤵
                PID:19404
              • C:\Windows\System32\mshta.exe
                "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                2⤵
                  PID:19340
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\AddInstall.html
                1⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:4836
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb13b46f8,0x7ffeb13b4708,0x7ffeb13b4718
                  2⤵
                    PID:5076
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1516,1381798947879771712,15644604238295810115,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                    2⤵
                      PID:3252
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,1381798947879771712,15644604238295810115,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5088
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1516,1381798947879771712,15644604238295810115,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
                      2⤵
                        PID:1644
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1516,1381798947879771712,15644604238295810115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
                        2⤵
                          PID:1812
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1516,1381798947879771712,15644604238295810115,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                          2⤵
                            PID:772
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1508
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:5260
                            • C:\Windows\system32\taskmgr.exe
                              "C:\Windows\system32\taskmgr.exe" /4
                              1⤵
                              • Checks SCSI registry key(s)
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:37952
                            • C:\Windows\system32\vssvc.exe
                              C:\Windows\system32\vssvc.exe
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:19292

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Windows Management Instrumentation

                            1
                            T1047

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Defense Evasion

                            Direct Volume Access

                            1
                            T1006

                            Indicator Removal

                            2
                            T1070

                            File Deletion

                            2
                            T1070.004

                            Modify Registry

                            1
                            T1112

                            Credential Access

                            Credentials from Password Stores

                            2
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Windows Credential Manager

                            1
                            T1555.004

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            1
                            T1120

                            Query Registry

                            3
                            T1012

                            System Information Discovery

                            4
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Inhibit System Recovery

                            2
                            T1490

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id-3444597F.[[email protected]].ncov
                              Filesize

                              2.7MB

                              MD5

                              d1e8d8a2d4fddf46c42c0eaa1bcaf3c5

                              SHA1

                              1fdffffcbe1c6a7cb065ba0ce4c74f57ab38d01c

                              SHA256

                              bde274f09bae7501af0b4a29988d6a5b6f58cb9ba76332b62cce895763e5b322

                              SHA512

                              fa0cddf55f6c3f63f956d5014a25acb1d5026c672254174fdde988796c1fa1c08a022655cab5d47744fc0f4c42339c80ab87418c44498e1fb602f10472deb850

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              d071abd21ba95452bd70e7274b2139b6

                              SHA1

                              75ea5ccc5ad04b9634e377b286fc99c448f07891

                              SHA256

                              973e07a348e7b2dba242b74f59a5d3d690842f19be76dd15a5e693992f08f142

                              SHA512

                              af42a390439b837dfffa305f21fb573b6f2028bbf767d7dcf239900fbcbb8d4e7015d37a8c52bb513bad60f6f5039d4e699acf8b5135b24e8d0e26a1d96d9b5f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              102f253d13f1fcbd58ff7ea07502d0f9

                              SHA1

                              17fa9662f4778117d415f7821ad2f9eb549832c1

                              SHA256

                              6d75e75b1174af3c7b730d9d4a397e5c1b53c6935f7c4ea675da4e42a9f6559d

                              SHA512

                              5401a9bd5aab0b6add34e79e644916c3869198b3310c47aa8a845ab2d4d566d973c2a56e888c675c96bd04d2e1cbc756189f9122d6ce4b88cdbcbe1186ca7eb9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              69cbb07cb6469eae85930d1ea99cad08

                              SHA1

                              f192d234edcd3ddeedc4e662aaa17563003750a9

                              SHA256

                              39e8e4386b55e29218bb892a314942be3c79eac2825d7efcacf9ef5e5ea5939a

                              SHA512

                              076a3ae60e127159ee51840c334be4f3d6119869f042454e95341e908f0694457ce47fde8c1494bd9701d5ba50be2c728455319fd24e905e18d538907e9ff5ec

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              81d9626a268f4fdea5d202677f15d79e

                              SHA1

                              dbc72e3e822f28cb44ad677cc71ab905b494ba0f

                              SHA256

                              2396525adf259a50c6f16e579838459a628914a26664ec3c5e677dec8b2a6fae

                              SHA512

                              43788823b3e36efcd14ff4ee4809c0dc4e2737886931242e3ece39966d14cabed0a7c4ebbe382108cd089f77e21610d0d27d9696d34f447adc72ba42918b18b1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              1366f9915712740527f9a5ff0a2e0cbc

                              SHA1

                              6077e491ee1d5dfeae50e1211ae7fff210d74163

                              SHA256

                              b4102c4fe641290fa0ce5a6d312f545933e81bc2e9b11c3a66f5af998d24f6ba

                              SHA512

                              088f193b1d278bc9f339be874d40b51b89127a6cd87d80edb59631fc5a20c5d6ac210f14d116b650fa85b33d6ddb1bda89b2964f2ab1093fa1272fc257565f5e

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
                              Filesize

                              4.8MB

                              MD5

                              4c45c719d10b7c2b9cfae58f087007f9

                              SHA1

                              e77488a2de734149b35a20a66a53d123b5e404ba

                              SHA256

                              f4d64bf16ca386449d6ba5385607aedaf749c6087375c9adffc51af6ea8842cc

                              SHA512

                              95041ee415b0baa82a7ac742c91bf365a2ac9fb0f324f7e38a87308f632d376115ceb6258c1f142ddbcc585015f4cbab06b2b6574d7342b765cffd6c01d0b948

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              10KB

                              MD5

                              21e2b0851a589950f13821a11dccfed6

                              SHA1

                              256191009012d9294874f5f58d7e9941bb08ae91

                              SHA256

                              006d128991df2dd17c16cae054e8bd59c3f09f2ee00a6a3e65f498a3775cb4ae

                              SHA512

                              fe2fce14985910b9f7105a8ae5e37376182ed9b24f33e6552df0978a4b932c95a13c9de9ca765c1d7c7d39bb18226cf930d3625bfd30fb676f9f136a61ed91a2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              10KB

                              MD5

                              2501d15624d2f9283c40bfeb8c935ec5

                              SHA1

                              c3b9d83e87544d340038bb92bdfa6f0f0d51088e

                              SHA256

                              34c6cd4a3c6aa5849c53c7e469214eedc237c481fc0726f801b757d787554831

                              SHA512

                              d69d62dee4cc91fb4dcb026b9b46e915f51ca5b54b01c32aa221ab096742729daef26d7e462e1a73f8df65afe34c3b623437e73184b9dc3d19b9bd0efcc74f26

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
                              Filesize

                              13KB

                              MD5

                              dab17e3e0ddbc0619caf840138b41e90

                              SHA1

                              48808c24214e667bde215ee9591477a3daa38722

                              SHA256

                              200faaada4c9a2d5185b8e6e097a7df23d31723acddac5482ca9df4948d2bf5e

                              SHA512

                              2031dfb2b658c19f51611a3dbed82e2bdc5180894c231108ff7181dc7c7ab5e48139f6a9afd615e386cc09c03192d7862167f0a65d3241a6f4c3bc25177e4d30

                              Download Submit

                            • memory/3804-4487-0x0000000000400000-0x000000000056F000-memory.dmp

                              Filesize

                              1.4MB

                              Download

                            • memory/3804-19-0x0000000000400000-0x000000000056F000-memory.dmp

                              Filesize

                              1.4MB

                              Download

                            • memory/3804-18768-0x000000000ADB0000-0x000000000ADE4000-memory.dmp

                              Filesize

                              208KB

                              Download

                            • memory/3804-0-0x0000000000400000-0x000000000056F000-memory.dmp

                              Filesize

                              1.4MB

                              Download

                            • memory/3804-7-0x000000000ADB0000-0x000000000ADE4000-memory.dmp

                              Filesize

                              208KB

                              Download