{ "type": "bundle", "id": "bundle--5ee3822c-6828-418c-b619-62de950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f", "created": "2020-06-21T12:25:57.000Z", "modified": "2020-06-21T12:25:57.000Z", "name": "The DFIR Report", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5ee3822c-6828-418c-b619-62de950d210f", "created_by_ref": "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f", "created": "2020-06-21T12:25:57.000Z", "modified": "2020-06-21T12:25:57.000Z", "name": "Dharma Ransomware Event", "published": "2020-06-21T12:26:28Z", "object_refs": [ "indicator--5ee3839a-07e0-4533-8ed9-fe83950d210f", "indicator--5ee395a3-54c0-4f88-a035-433e950d210f", "observed-data--5ee8b501-bf98-4bb7-85ff-487d950d210f", "url--5ee8b501-bf98-4bb7-85ff-487d950d210f", "indicator--5ee38271-b93c-40b2-83ac-4ade950d210f", "indicator--5ee3827b-96ac-4da2-8d46-4ade950d210f", "indicator--5ee38287-bc8c-462b-863d-2f22950d210f", "indicator--5ee382ca-87f8-4144-86b7-fe8b950d210f", "indicator--5ee38314-c71c-4493-ae54-40a6950d210f", "indicator--5ee38343-f910-44d1-b837-fe5d950d210f" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:malpedia=\"Dharma\"", "misp-galaxy:ransomware=\"Dharma Ransomware\"", "Ransomware", "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"", "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"", "misp-galaxy:mitre-attack-pattern=\"Scripting - T1064\"", "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"", "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"", "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ee3839a-07e0-4533-8ed9-fe83950d210f", "created_by_ref": "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f", "created": "2020-06-12T13:31:06.000Z", "modified": "2020-06-12T13:31:06.000Z", "description": "rdp actor login source", "pattern": "[network-traffic:src_ref.type = 'ipv4-addr' AND network-traffic:src_ref.value = '217.138.202.116']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2020-06-12T13:31:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-src\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ee395a3-54c0-4f88-a035-433e950d210f", "created_by_ref": "identity--5e9e5d86-5b94-4ff6-b07e-4e3e950d210f", "created": "2020-06-12T14:48:03.000Z", "modified": "2020-06-12T14:48:03.000Z", "pattern": "[/*\r\n YARA Rule Set\r\n Author: DFIR Report\r\n Date: 2020-06-12\r\n Identifier: dharma-06-12-20\r\n Reference: https://thedfirreport.com/\r\n*/\r\n\r\n/* Rule Set ----------------------------------------------------------------- */\r\n\r\nimport \"pe\"\r\n\r\nrule vssadmin_Shadow_bat {\r\n meta:\r\n description = \"dharma-06-12-20 - file Shadow.bat\"\r\n author = \"DFIR Report\"\r\n reference = \"https://thedfirreport.com/\"\r\n date = \"2020-06-12\"\r\n hash1 = \"da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878\"\r\n strings:\r\n $s1 = \"vssadmin delete shadows /all\" fullword ascii\r\n condition:\r\n uint16(0) == 0x7376 and filesize < 1KB and\r\n all of them\r\n}\r\n\r\nrule Network_Scanner_post_exploit_enumeration {\r\n meta:\r\n description = \"dharma-06-12-20 - file NS.exe\"\r\n author = \"DFIR Report\"\r\n reference = \"https://thedfirreport.com/\"\r\n date = \"2020-06-12\"\r\n hash1 = \"f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446\"\r\n strings:\r\n $s1 = \"CreateMutex error: %d\" fullword ascii\r\n $s2 = \"--Error mount \\\\\\\\%s\\\\%s Code: %d\" fullword wide\r\n $s3 = \"-Found share \\\\\\\\%s\\\\%s\" fullword wide\r\n $s4 = \"--Share \\\\\\\\%s\\\\%s successfully mounted\" fullword wide\r\n $s5 = \"host %s is up\" fullword ascii\r\n $s6 = \"Get ip: %s and mask: %s\" fullword wide\r\n $s7 = \"GetAdaptersInfo failed with error: %d\" fullword wide\r\n $s8 = \"# Network scan and mount include chek for unmounted local volumes. #\" fullword wide\r\n $s9 = \"####################################################################\" fullword wide /* reversed goodware string '####################################################################' */\r\n $s10 = \"Share %s successfully mounted\" fullword wide\r\n $s11 = \"Error mount %s %d\" fullword wide\r\n $s12 = \"Failed to create thread.\" fullword ascii\r\n $s13 = \" start scan for shares. \" fullword wide\r\n $s14 = \"# '98' was add for standalone usage! #\" fullword wide\r\n $s15 = \"Error, wrong value.\" fullword wide\r\n $s16 = \"QueryDosDeviceW failed with error code %d\" fullword wide\r\n $s17 = \"FindFirstVolumeW failed with error code %d\" fullword wide\r\n $s18 = \"FindNextVolumeW failed with error code %d\" fullword wide\r\n $s19 = \"SetVolumeMountPointW failed with error code %d\" fullword wide\r\n $s20 = \"| + scan local volumes for unmounted drives. |\" fullword wide\r\n condition:\r\n uint16(0) == 0x5a4d and filesize < 400KB and\r\n ( pe.imphash() == \"0b0d8152ea7241cce613146b80a998fd\" or 8 of them )\r\n}\r\n\r\nrule Dharma_ransomware_1pgp {\r\n meta:\r\n description = \"dharma-06-12-20 - file 1pgp.exe\"\r\n author = \"DFIR Report\"\r\n reference = \"https://thedfirreport.com/\"\r\n date = \"2020-06-12\"\r\n hash1 = \"2f2e75affe9217c7211043936678fb1777e2db4a8f1986b8805ddb1e84e9e99b\"\r\n strings:\r\n $x1 = \"C:\\\\crysis\\\\Release\\\\PDB\\\\payload.pdb\" fullword ascii\r\n $s2 = \"sssssbsss\" fullword ascii\r\n $s3 = \"sssssbs\" fullword ascii\r\n $s4 = \"9c%Q%f\" fullword ascii\r\n $s5 = \"jNYZO\\\\\" fullword ascii\r\n $s6 = \"RSDS%~m\" fullword ascii\r\n $s7 = \"xy ?*5\" fullword ascii\r\n $s8 = \"Eve\" ascii\r\n $s9 = \"; settings stored in %APPDATA%\\\\Everything\\\\Everything.ini\" fullword ascii\r\n $s10 = \"Host the pipe server with the security descriptor.\" fullword ascii\r\n $s11 = \"http://www.voidtools.com/support/everything/\" fullword ascii\r\n $s12 = \"username:password@host:port\" fullword ascii\r\n $s13 = \"