Analysis
-
max time kernel
156s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2023 04:02
Static task
static1
Behavioral task
behavioral1
Sample
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe
-
Size
92KB
-
MD5
f0d51246d6655e30178634fee2792710
-
SHA1
9757d10f4b4d2d18a996ca18507a0450654caf53
-
SHA256
40a68110241e86f1cdece1dc5a6dfb72e028b40e8d55447cc3a961341b932784
-
SHA512
fc1ee9cf97e720c0e522715b42432c195cd9471db4b5266c0cf4b4346b26e3e2355d2317f1701d5d09981e4ac28ab2413015efce7d4a71d6958ae2b529b8509d
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AkToiOJqIi16U14dJzpTdh7Y2+ZBy55sL:Qw+asqN5aW/hLlBxRU14T5duO5E
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
alladin@cock.li
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe -
Drops startup file 5 IoCs
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe = "C:\\Windows\\System32\\2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe" 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-144354903-2550862337-1367551827-1000\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Public\Music\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe -
Drops file in System32 directory 2 IoCs
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exedescription ioc process File created C:\Windows\System32\2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Windows\System32\Info.hta 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\ui-strings.js.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\css\main-selector.css 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\sawindbg.dll.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.png.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_20x20x32.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Snooze.scale-80.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\hu-hu\ui-strings.js.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-96_altform-unplated.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\sfs_icons.png.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\cloud_secured.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.ps1 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_hi.dll 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\es-419.pak.DATA.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODEXL.DLL.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\msedge_7z.data 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White@3x.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_fil.dll.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent@2x.png.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ko-kr\ui-strings.js.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.CoreProviders.resources.dll.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeLinguistic.dll 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\nexturl.ort.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\plugin.js 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.Tile.winmd 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\msointlimm.dll 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag-dark@3x.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\Newtonsoft.Json.dll 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\LICENSE 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\THMBNAIL.PNG.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_TW.properties.id-496BBABA.[alladin@cock.li].bip 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\trash.gif 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2656 vssadmin.exe 4980 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exepid process 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 3232 vssvc.exe Token: SeRestorePrivilege 3232 vssvc.exe Token: SeAuditPrivilege 3232 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
2023-04-15_f0d51246d6655e30178634fee2792710_crysis.execmd.execmd.exedescription pid process target process PID 5076 wrote to memory of 364 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe cmd.exe PID 5076 wrote to memory of 364 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe cmd.exe PID 364 wrote to memory of 1780 364 cmd.exe mode.com PID 364 wrote to memory of 1780 364 cmd.exe mode.com PID 364 wrote to memory of 2656 364 cmd.exe vssadmin.exe PID 364 wrote to memory of 2656 364 cmd.exe vssadmin.exe PID 5076 wrote to memory of 1948 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe cmd.exe PID 5076 wrote to memory of 1948 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe cmd.exe PID 1948 wrote to memory of 5080 1948 cmd.exe mode.com PID 1948 wrote to memory of 5080 1948 cmd.exe mode.com PID 1948 wrote to memory of 4980 1948 cmd.exe vssadmin.exe PID 1948 wrote to memory of 4980 1948 cmd.exe vssadmin.exe PID 5076 wrote to memory of 4196 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe mshta.exe PID 5076 wrote to memory of 4196 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe mshta.exe PID 5076 wrote to memory of 288 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe mshta.exe PID 5076 wrote to memory of 288 5076 2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe"C:\Users\Admin\AppData\Local\Temp\2023-04-15_f0d51246d6655e30178634fee2792710_crysis.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-496BBABA.[alladin@cock.li].bipFilesize
2.9MB
MD5954337820413e2ed470448713557d529
SHA137f11acabc6d452cf3a0a42c18f2d5090455ea24
SHA256a39d1391f37deafe0b0f2cdc3ed7be93c6d755d03dad0cdc23bea5b0743e5cfe
SHA51271ba6175e3ff7f1b53c4b04c3a929e4d4d138b2ba97e43fd209c1bf5d2c4088ce51316ba4991eda697f0f077e4d5e78328441ab205cddf4601475b49aade8b6c
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5d5b2f88af8fa47fad730ab6031260ff6
SHA1f36857b9bee0597ac56be11049b6157652243511
SHA2567c784443b75f3bcdabd5b423539c55df9dd0204abbeca16d139dfc8f10378041
SHA51230da81939e4c9a84208784f430dfa5e2f43122ca60e0ddb5fa0a1d08463994723c81ec495256b33c18c83994b9dfa08698c495eae893e8a847cdfb52f95215fe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
13KB
MD5d5b2f88af8fa47fad730ab6031260ff6
SHA1f36857b9bee0597ac56be11049b6157652243511
SHA2567c784443b75f3bcdabd5b423539c55df9dd0204abbeca16d139dfc8f10378041
SHA51230da81939e4c9a84208784f430dfa5e2f43122ca60e0ddb5fa0a1d08463994723c81ec495256b33c18c83994b9dfa08698c495eae893e8a847cdfb52f95215fe