Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-05-2023 10:43
Static task
static1
Behavioral task
behavioral1
Sample
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe
-
Size
92KB
-
MD5
7821b1f09ffbf4810840b2f1b326ec77
-
SHA1
79dfb55c1413f5bd48a8783f8eabcea7981078a5
-
SHA256
84b3135339c05c2271fff9c90d0d3845c84b4fde8defe62aa8a73d8616b24f8f
-
SHA512
00f47a82af272923a13185a90c3247cf4fc17e04f79b06e05f2e9b54287ccf9a464c724946eb28ca351861399dc2e2154f67d3db982db3a5cb16c90087800a77
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AvhQFlcykQLaR4zs4+a6qgHR:Qw+asqN5aW/hLJrxxdHR
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
xcorp@decoymail.mx
whisper@mailfence.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\ResumeApprove.tiff 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe -
Drops startup file 5 IoCs
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe -
Loads dropped DLL 8 IoCs
Processes:
MsiExec.exeMsiExec.exepid process 3216 MsiExec.exe 3216 MsiExec.exe 3216 MsiExec.exe 3216 MsiExec.exe 3216 MsiExec.exe 3216 MsiExec.exe 3216 MsiExec.exe 2904 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe = "C:\\Windows\\System32\\2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe" 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Music\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U3375IQM\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\XS6M157B\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1XDFWCRE\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IPUXPVVT\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3430344531-3702557399-3004411149-1000\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HC7ZN6SY\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\PLKQQS67\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe -
Drops file in System32 directory 2 IoCs
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exedescription ioc process File created C:\Windows\System32\2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Windows\System32\Info.hta 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exedescription ioc process File created C:\Program Files\Java\jre7\bin\javaw.exe.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186360.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382931.JPG.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106222.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\Hearts.exe.mui.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21315_.GIF.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00608_.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02126_.WMF.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Windows Media Player\WMPSideShowGadget.exe 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04369_.WMF.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152622.WMF.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\SPRING.ELM.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Marketing Projects.accdt.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLLIBR.DLL.IDX_DLL.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02093_.WMF.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\msinfo32.exe.mui 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\bin\ssv.dll.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files\VideoLAN\VLC\locale\ckb\LC_MESSAGES\vlc.mo.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00453_.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\SNET.NET.XML 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guatemala 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutDomain.ico.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\ELPHRG01.WAV.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WSIDBR98.POC.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST7MDT.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AssemblyInfoInternal.zip.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Solstice.eftx 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199423.WMF.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18194_.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OFFLINE.ICO.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\SHOT.WAV.id-85E2D70F.[xcorp@decoymail.mx].xCor 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00525_.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02405_.WMF 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe -
Drops file in Windows directory 13 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\MSIC70.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI10F4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1162.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI129B.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI1C5F.tmp msiexec.exe File created C:\Windows\Installer\6d0ba5.mst msiexec.exe File opened for modification C:\Windows\Installer\6d0ba5.mst msiexec.exe File opened for modification C:\Windows\Installer\MSI1BC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1C00.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI21CC.tmp msiexec.exe File created C:\Windows\Installer\6d0ba7.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI1AF5.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 1736 vssadmin.exe 620 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry class 7 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit\command msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\shell\edit msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx\IconHandler msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\ShellEx msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\xmlfile\DefaultIcon msiexec.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exemsiexec.exepid process 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 1200 msiexec.exe 1200 msiexec.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
vssvc.exemsiexec.exedescription pid process Token: SeBackupPrivilege 748 vssvc.exe Token: SeRestorePrivilege 748 vssvc.exe Token: SeAuditPrivilege 748 vssvc.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeSecurityPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe Token: SeRestorePrivilege 1200 msiexec.exe Token: SeTakeOwnershipPrivilege 1200 msiexec.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.execmd.exemsiexec.execmd.exedescription pid process target process PID 828 wrote to memory of 1716 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 828 wrote to memory of 1716 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 828 wrote to memory of 1716 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 828 wrote to memory of 1716 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 1716 wrote to memory of 1684 1716 cmd.exe mode.com PID 1716 wrote to memory of 1684 1716 cmd.exe mode.com PID 1716 wrote to memory of 1684 1716 cmd.exe mode.com PID 1716 wrote to memory of 1736 1716 cmd.exe vssadmin.exe PID 1716 wrote to memory of 1736 1716 cmd.exe vssadmin.exe PID 1716 wrote to memory of 1736 1716 cmd.exe vssadmin.exe PID 1200 wrote to memory of 3216 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 3216 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 3216 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 3216 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 3216 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 3216 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 3216 1200 msiexec.exe MsiExec.exe PID 828 wrote to memory of 2204 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 828 wrote to memory of 2204 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 828 wrote to memory of 2204 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 828 wrote to memory of 2204 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe cmd.exe PID 2204 wrote to memory of 2528 2204 cmd.exe mode.com PID 2204 wrote to memory of 2528 2204 cmd.exe mode.com PID 2204 wrote to memory of 2528 2204 cmd.exe mode.com PID 2204 wrote to memory of 620 2204 cmd.exe vssadmin.exe PID 2204 wrote to memory of 620 2204 cmd.exe vssadmin.exe PID 2204 wrote to memory of 620 2204 cmd.exe vssadmin.exe PID 828 wrote to memory of 1856 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 828 wrote to memory of 1856 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 828 wrote to memory of 1856 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 828 wrote to memory of 1856 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 828 wrote to memory of 3824 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 828 wrote to memory of 3824 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 828 wrote to memory of 3824 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 828 wrote to memory of 3824 828 2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe mshta.exe PID 1200 wrote to memory of 2904 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 2904 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 2904 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 2904 1200 msiexec.exe MsiExec.exe PID 1200 wrote to memory of 2904 1200 msiexec.exe MsiExec.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe"C:\Users\Admin\AppData\Local\Temp\2023-05-29_7821b1f09ffbf4810840b2f1b326ec77_crysis.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 34B75F209F81D71BE9DCD9E9A1DDBAD02⤵
- Loads dropped DLL
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 6351C727F2DCA80E421224CB2D51D04E2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-85E2D70F.[xcorp@decoymail.mx].xCorFilesize
6.3MB
MD55380bf6792267890556936ee6ba94a97
SHA1823dd30e19cc260618e2b4150985d2f6b340a2ba
SHA25639ccfe5115e3de62e072c4367ace0a0c6266b4d153b177000aaf900a34a6d187
SHA5129778c936846cdd99891ce85d873b165283fcc5ac6797195a1560378b8802242fb81b1a2f5f887fd8359191102786e05cd0531c14bcba0280b14fa7c3667a349a
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
4KB
MD5f7f8d912e41a4519ee10c5d8208cef3f
SHA1107affa32d5d5ac183dcbfb3e01005912ebddf4b
SHA25672f7cb78fc0e123501676ee33ac1ec57c2c96083b074cc440a89be2324396459
SHA5125a2ff26f4add9c8a005e9614e64cc2c649b4b59e979f9aea67155b7146b2a9311f316ac115cb77fc63b58d2ff928439a2efbfb9c9f18580313481c82c1d0c6d4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
4KB
MD5f7f8d912e41a4519ee10c5d8208cef3f
SHA1107affa32d5d5ac183dcbfb3e01005912ebddf4b
SHA25672f7cb78fc0e123501676ee33ac1ec57c2c96083b074cc440a89be2324396459
SHA5125a2ff26f4add9c8a005e9614e64cc2c649b4b59e979f9aea67155b7146b2a9311f316ac115cb77fc63b58d2ff928439a2efbfb9c9f18580313481c82c1d0c6d4
-
C:\Windows\Installer\MSI10F4.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\Installer\MSI1162.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\Installer\MSI129B.tmpFilesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
C:\Windows\Installer\MSI1AF5.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
C:\Windows\Installer\MSI1C00.tmpFilesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
-
C:\Windows\Installer\MSI1C5F.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\Installer\MSI1C5F.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
C:\Windows\Installer\MSI21CC.tmpFilesize
86KB
MD5ff58cd07bf4913ef899efd2dfb112553
SHA1f14c1681de808543071602f17a6299f8b4ba2ae8
SHA2561afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA51223e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3
-
C:\Windows\Installer\MSIC70.tmpFilesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
\Windows\Installer\MSI10F4.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
\Windows\Installer\MSI1162.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
\Windows\Installer\MSI129B.tmpFilesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
\Windows\Installer\MSI1AF5.tmpFilesize
28KB
MD585221b3bcba8dbe4b4a46581aa49f760
SHA1746645c92594bfc739f77812d67cfd85f4b92474
SHA256f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
-
\Windows\Installer\MSI1C00.tmpFilesize
148KB
MD533908aa43ac0aaabc06a58d51b1c2cca
SHA10a0d1ce3435abe2eed635481bac69e1999031291
SHA2564447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
SHA512d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
-
\Windows\Installer\MSI1C5F.tmpFilesize
363KB
MD54a843a97ae51c310b573a02ffd2a0e8e
SHA1063fa914ccb07249123c0d5f4595935487635b20
SHA256727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
SHA512905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
-
\Windows\Installer\MSI21CC.tmpFilesize
86KB
MD5ff58cd07bf4913ef899efd2dfb112553
SHA1f14c1681de808543071602f17a6299f8b4ba2ae8
SHA2561afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA51223e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3
-
\Windows\Installer\MSIC70.tmpFilesize
257KB
MD5d1f5ce6b23351677e54a245f46a9f8d2
SHA10d5c6749401248284767f16df92b726e727718ca
SHA25657cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
-
memory/3824-20238-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmpFilesize
64KB