Analysis
- user interaction
yes - max time kernel
8s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/07/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CoronaVirus.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
CoronaVirus.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target CoronaVirus.exe
- Size 1.0MB
- Sample260715-e5zkwaev71
- SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
- MD5 055d1462f66a350d9886542d4d79bc2b
- SHA1 f1086d2f667d807dbb1aa362a7a809ea119f2565
- SHA512 2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1
- SSDEEP 24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2
- TLSH T18F357D22E6A390F1C0652170BD6EB7FF99273C544F1889E7A3D4361C6AB01D10DFBA96
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe CoronaVirus.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe" CoronaVirus.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini CoronaVirus.exe File opened for modification C:\Program Files\desktop.ini CoronaVirus.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini CoronaVirus.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\CoronaVirus.exe CoronaVirus.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\LICENSE.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaremr.dll CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\7z.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\7-Zip\Lang\is.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\7-Zip\Lang\mng.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash CoronaVirus.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb CoronaVirus.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui CoronaVirus.exe File created C:\Program Files\7-Zip\readme.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-util-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\7-Zip\Lang\hy.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\7-Zip\Lang\lt.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt CoronaVirus.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll CoronaVirus.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml CoronaVirus.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File created C:\Program Files\7-Zip\Lang\cy.txt.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui CoronaVirus.exe File created C:\Program Files\7-Zip\7z.exe.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui CoronaVirus.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdfmap.dll CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\dbgshim.dll.id-B7030AAD.[[email protected]].ncov CoronaVirus.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt CoronaVirus.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml CoronaVirus.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CoronaVirus.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 27588 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3280 CoronaVirus.exe 3280 CoronaVirus.exe 3280 CoronaVirus.exe 3280 CoronaVirus.exe 3280 CoronaVirus.exe 3280 CoronaVirus.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3280 wrote to memory of 3784 3280 CoronaVirus.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"C:\Users\Admin\AppData\Local\Temp\CoronaVirus.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:3784
-
C:\Windows\system32\mode.commode con cp select=12513⤵PID:40072
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:27588
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:37508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ConvertInvoke.potm.id-B7030AAD.[[email protected]].ncov
- Path C:\Program Files\ConvertInvoke.potm.id-B7030AAD.[[email protected]].ncov
- Size 2.3MB
- SHA256 7b4082674ca5be1c8fe02af03ce68bb5664cc6d496c1e94c227c018040cf00ea
- MD5 3ca2f7c16268b4c41b2d77c6296e73c7
- SHA1 98cf0795dbdcf6d44fdd4b1829bba2d14f183c41
- SHA512 817c0fef2a4d526c672dc2597b6c5e6ed91af5dd2c3465df6cc92eb4d002d13a8f030929c150b9fa37ef214e05037d9c53d6d80126b152c6cdd918a2154e2e82
- SSDEEP 24576:6xls0q/YbOJcqZ7K6+8/pbrUnNLWFPUEvBnPINwtOU99:6bsHYbOo6+mRdR5nPChy
- TLSH T1D6B5338187653E40F16060FDE22AE86C3E78E745945B927CBBCE1D06EFA581643363F9
- MD5 SHA1 SHA512 SSDEEP TLSH