Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2023 02:59
Static task
static1
Behavioral task
behavioral1
Sample
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe
-
Size
92KB
-
MD5
786ce74458720ec55b824586d2e5666d
-
SHA1
6f62e7fe75a0876939e0dd95d314b83e25e1e395
-
SHA256
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
-
SHA512
083fe6cde08dac05043ecc0fdbc8b26b0764de7f651ad19e96a937bc27de96242f1763b701b308eab7e0b9a8dd88cbc45e9c891de505b5348581acd4e1495c33
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4A9eAzVbobr+t+NK1GcoDc50cO2tqpbe:Qw+asqN5aW/hL2UVEnHKIcAtcO2tqpb
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
datacentreback@msgsafe.io
moriartydata@onionmail.org
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\UseBlock.tiff 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Drops startup file 5 IoCs
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe = "C:\\Windows\\System32\\2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe" 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Public\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-144354903-2550862337-1367551827-1000\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Public\Music\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Drops file in System32 directory 2 IoCs
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exedescription ioc process File created C:\Windows\System32\2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Windows\System32\Info.hta 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_altform-unplated.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-63.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200_altform-lightunplated.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-64_altform-lightunplated.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons.png.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FirstRunCalendarBlurred.layoutdir-LTR.jpg 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-200.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\PREVIEW.GIF.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\ui-strings.js.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x64\msvpxenc.dll 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_am.dll 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\EnableCopy.ps1xml.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-150_contrast-white.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSBARCODE.DLL.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.173.45\msedgeupdateres_sr-Cyrl-RS.dll.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\main.css.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CENTURY.TTF.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_zh-CN.dll 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ca-es\ui-strings.js.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\VBAJET32.DLL.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT532.CNV.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-48.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\tzdb.dat.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\QuizShow.potx.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\GroupSync.dwfx.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-black_scale-125.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-ae\ui-strings.js.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\meta-index.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-60_altform-unplated.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.173.45\msedgeupdateres_fa.dll 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sendopts.xml.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\AppXManifest.xml.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.rll 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\db2v0801.xsl.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\ui-strings.js 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\illustrations.png 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\canary.identity_helper.exe.manifest.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\export.svg.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms.id-AA828466.[datacentreback@msgsafe.io].data 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2472 vssadmin.exe 1056 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exepid process 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4220 vssvc.exe Token: SeRestorePrivilege 4220 vssvc.exe Token: SeAuditPrivilege 4220 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.execmd.execmd.exedescription pid process target process PID 648 wrote to memory of 2384 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe cmd.exe PID 648 wrote to memory of 2384 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe cmd.exe PID 2384 wrote to memory of 2508 2384 cmd.exe mode.com PID 2384 wrote to memory of 2508 2384 cmd.exe mode.com PID 2384 wrote to memory of 2472 2384 cmd.exe vssadmin.exe PID 2384 wrote to memory of 2472 2384 cmd.exe vssadmin.exe PID 648 wrote to memory of 3556 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe cmd.exe PID 648 wrote to memory of 3556 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe cmd.exe PID 3556 wrote to memory of 5180 3556 cmd.exe mode.com PID 3556 wrote to memory of 5180 3556 cmd.exe mode.com PID 3556 wrote to memory of 1056 3556 cmd.exe vssadmin.exe PID 3556 wrote to memory of 1056 3556 cmd.exe vssadmin.exe PID 648 wrote to memory of 2264 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe mshta.exe PID 648 wrote to memory of 2264 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe mshta.exe PID 648 wrote to memory of 1592 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe mshta.exe PID 648 wrote to memory of 1592 648 2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe"C:\Users\Admin\AppData\Local\Temp\2023-05-12_786ce74458720ec55b824586d2e5666d_crysis.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-AA828466.[datacentreback@msgsafe.io].dataFilesize
2.9MB
MD52d665c27d5167cf881d42557346f17d6
SHA132a6daf58c92616f29454dcbe028a054d71f314a
SHA256bad484d6b98006eaa5f9178d14c336c2b5aec3efa847583f3bbb7e429558606a
SHA512714e33d5d9acc712cdd65de107c1e3a0385eaff51c46828f900544239407ea8a1f90fafdddc7b9ac4b4fd7ab354595c5445005eee7ed9c5225f421a6f0c47221
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5204eb47ae3737636f41cb838515310b1
SHA14dbba4c98bc806c8128ca9d80b4442dbf0144f39
SHA256a333fe6919cb2d868b89507356fb42724c7cfd881b2c241a26334de338b7958c
SHA5124b030814820f04175737c26e42f92d474459b97bf1fa6cdd11c57970c6a9acaa8f0feb1ebdbfe57c230dd4d4602c9f67765cd22717407edfa779f3f4dfd233d6
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD5204eb47ae3737636f41cb838515310b1
SHA14dbba4c98bc806c8128ca9d80b4442dbf0144f39
SHA256a333fe6919cb2d868b89507356fb42724c7cfd881b2c241a26334de338b7958c
SHA5124b030814820f04175737c26e42f92d474459b97bf1fa6cdd11c57970c6a9acaa8f0feb1ebdbfe57c230dd4d4602c9f67765cd22717407edfa779f3f4dfd233d6