Analysis
-
max time kernel
149s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-03-2023 18:50
Static task
static1
Behavioral task
behavioral1
Sample
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe
-
Size
92KB
-
MD5
29320eedebbf9198c3dad888578d0707
-
SHA1
9e32b1e3b4b96b5d0795d60cf2b1b9093c1df167
-
SHA256
0291e99acfedf4e277d56babb2783ce0a01e873a42627b4e3f4a56c2a10cc24d
-
SHA512
67e7db4c3d907192b79fcb37d78f7d7d00299b304f5125239d50a0d127034dd6098945d1ca20bed854811d1b4cfdc540ebc0bc017773a5813a96679e90a1f18d
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AEf1a9unhr3AFIvAuUbrcH/zFVc8leMb7bt:Qw+asqN5aW/hL5Mhr3AFIv0u487
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
WildMouse@cock.li
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 5 IoCs
Processes:
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe = "C:\\Windows\\System32\\2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe" 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exedescription ioc process File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D3FFX6WH\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M3HSS2N\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F9XZZTVM\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KDJSR44L\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2647223082-2067913677-935928954-1000\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D3BHGYNU\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FPRRZWTM\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Music\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2STIOPZK\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe -
Drops file in System32 directory 2 IoCs
Processes:
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exedescription ioc process File created C:\Windows\System32\2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Windows\System32\Info.hta 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00809_.WMF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SAFRI_01.MID.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15058_.GIF 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.png 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdarem.dll 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282932.WMF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\OCRHC.DAT.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKL.ICO.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232803.WMF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libes_plugin.dll.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01157_.WMF 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01748_.GIF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_zh_CN.jar 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Java\jre7\lib\management\jmxremote.access.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\LoginForm.zip 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MP00132_.WMF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSVCR71.DLL 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0233512.WMF 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.IDX_DLL.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7ES.DLL 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152708.WMF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\TimeCard.xltx 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB8.BDR 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Mozilla Firefox\application.ini.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File created C:\Program Files\Java\jre7\bin\javaws.exe.id-78CCDA1F.[WildMouse@cock.li].FUNNY 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_underline.gif 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 676 vssadmin.exe 524 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exepid process 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1156 vssvc.exe Token: SeRestorePrivilege 1156 vssvc.exe Token: SeAuditPrivilege 1156 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.execmd.execmd.exedescription pid process target process PID 1932 wrote to memory of 1596 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1932 wrote to memory of 1596 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1932 wrote to memory of 1596 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1932 wrote to memory of 1596 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1596 wrote to memory of 1872 1596 cmd.exe mode.com PID 1596 wrote to memory of 1872 1596 cmd.exe mode.com PID 1596 wrote to memory of 1872 1596 cmd.exe mode.com PID 1596 wrote to memory of 676 1596 cmd.exe vssadmin.exe PID 1596 wrote to memory of 676 1596 cmd.exe vssadmin.exe PID 1596 wrote to memory of 676 1596 cmd.exe vssadmin.exe PID 1932 wrote to memory of 1588 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1932 wrote to memory of 1588 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1932 wrote to memory of 1588 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1932 wrote to memory of 1588 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe cmd.exe PID 1588 wrote to memory of 228 1588 cmd.exe mode.com PID 1588 wrote to memory of 228 1588 cmd.exe mode.com PID 1588 wrote to memory of 228 1588 cmd.exe mode.com PID 1588 wrote to memory of 524 1588 cmd.exe vssadmin.exe PID 1588 wrote to memory of 524 1588 cmd.exe vssadmin.exe PID 1588 wrote to memory of 524 1588 cmd.exe vssadmin.exe PID 1932 wrote to memory of 1616 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe PID 1932 wrote to memory of 1616 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe PID 1932 wrote to memory of 1616 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe PID 1932 wrote to memory of 1616 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe PID 1932 wrote to memory of 1368 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe PID 1932 wrote to memory of 1368 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe PID 1932 wrote to memory of 1368 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe PID 1932 wrote to memory of 1368 1932 2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe"C:\Users\Admin\AppData\Local\Temp\2023-03-09_29320eedebbf9198c3dad888578d0707_crysis.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-78CCDA1F.[WildMouse@cock.li].FUNNYFilesize
23.5MB
MD5636c2f03872fb96948f3525005ebf0d3
SHA1323271a60a95fe51ddc2c7ebb8ffb93a008153f3
SHA2565e1297a5da8dba3c4fefea55bf96b8d3bd02449aa3c32a2656481fe2b3379e7a
SHA512f7e2acf293e23eefa2d389376bb962c248e459d9ca3ba451ee6f739a7fdca04abdef6d35f3c4bbb3663dfad149b76fbfc417f139b5cff5202d4dfda6023d9426
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5d387ed8a2df1ab830c04d3636730f47e
SHA14857979d6f1d1368652ef466e93387f1abbe9937
SHA2563d836b3b69b46a762fc2f88c14d0bcfc49416b26d5a3e75d08313dcd1911f31e
SHA5127e27cbf31279aa0d3f9df498e9ce69d97cc046e4f15136a26445f45840a0d3710cbfe6866af4eae32ae64b078da28f0dee4f31797edc090d1c41c5f1914bff83
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5d387ed8a2df1ab830c04d3636730f47e
SHA14857979d6f1d1368652ef466e93387f1abbe9937
SHA2563d836b3b69b46a762fc2f88c14d0bcfc49416b26d5a3e75d08313dcd1911f31e
SHA5127e27cbf31279aa0d3f9df498e9ce69d97cc046e4f15136a26445f45840a0d3710cbfe6866af4eae32ae64b078da28f0dee4f31797edc090d1c41c5f1914bff83
-
memory/1616-20163-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB