Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30/05/2023, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe
-
Size
92KB
-
MD5
4c6a424ad657cc896926ea9ba095dc77
-
SHA1
dcffd7bad08bd5ddd88f9dce66956b329f25fa26
-
SHA256
017b9f584f114b80d16295204766121250f9178bf7c6bbbc2545f448fdf43cac
-
SHA512
77007125ba292109ca63dacffca3507276bfa3ec4c0a91bd3d35a13087d19f1e108dbd37caa223e802c11c69d84ca30a1a966387cc0ace1b243e495c6326e1b0
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4ALIuoiaqPZbIz4zQmm+7PAplOLsN4WZ:Qw+asqN5aW/hLNjoT8zF7Pf
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe = "C:\\Windows\\System32\\2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe" 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KDJSR44L\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D3FFX6WH\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2STIOPZK\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\D3BHGYNU\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTIFN44A\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F9XZZTVM\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\Info.hta 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Windows\System32\2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\localizedStrings.js 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\libsubsdelay_plugin.dll.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00853_.WMF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15132_.GIF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImageMask.bmp 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NL7Models0011.DLL.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9B.GIF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NAVBAR11.POC.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_up.png 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00602_.WMF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00726_.WMF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR39F.GIF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.HXS.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\Microsoft.Ink.dll 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN081.XML.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107342.WMF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\UserControl.zip.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\La_Paz.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\ECHO.INF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.common_2.10.1.v20140901-1043.jar.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.clusters.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OnLineBusy.ico.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00914_.WMF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Thatch.thmx 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\THEMES.INF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Almaty 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03011U.BMP 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01743_.GIF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0286034.WMF 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV.id-4C3CF02E.[[email protected]].data 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1384 vssadmin.exe 1684 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1000 vssvc.exe Token: SeRestorePrivilege 1000 vssvc.exe Token: SeAuditPrivilege 1000 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 316 wrote to memory of 756 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 28 PID 316 wrote to memory of 756 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 28 PID 316 wrote to memory of 756 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 28 PID 316 wrote to memory of 756 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 28 PID 756 wrote to memory of 596 756 cmd.exe 30 PID 756 wrote to memory of 596 756 cmd.exe 30 PID 756 wrote to memory of 596 756 cmd.exe 30 PID 756 wrote to memory of 1384 756 cmd.exe 31 PID 756 wrote to memory of 1384 756 cmd.exe 31 PID 756 wrote to memory of 1384 756 cmd.exe 31 PID 316 wrote to memory of 1108 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 35 PID 316 wrote to memory of 1108 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 35 PID 316 wrote to memory of 1108 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 35 PID 316 wrote to memory of 1108 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 35 PID 1108 wrote to memory of 1688 1108 cmd.exe 37 PID 1108 wrote to memory of 1688 1108 cmd.exe 37 PID 1108 wrote to memory of 1688 1108 cmd.exe 37 PID 1108 wrote to memory of 1684 1108 cmd.exe 38 PID 1108 wrote to memory of 1684 1108 cmd.exe 38 PID 1108 wrote to memory of 1684 1108 cmd.exe 38 PID 316 wrote to memory of 2976 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 39 PID 316 wrote to memory of 2976 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 39 PID 316 wrote to memory of 2976 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 39 PID 316 wrote to memory of 2976 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 39 PID 316 wrote to memory of 3036 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 40 PID 316 wrote to memory of 3036 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 40 PID 316 wrote to memory of 3036 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 40 PID 316 wrote to memory of 3036 316 2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe"C:\Users\Admin\AppData\Local\Temp\2023-05-29_4c6a424ad657cc896926ea9ba095dc77_crysis.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:596
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1384
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1688
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1684
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2976
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3036
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.id-4C3CF02E.[[email protected]].data
Filesize6.3MB
MD5b06f1daa40b1d39a7a14c1f325aedcad
SHA1375e4d87db9e7275b211f42de0cae2f1cfc2f8b4
SHA256fe755b566751961487aab60c4284b623a776a579e432fdcef1d7a18fc984d273
SHA512c36a5914cc06f89e82dc0e79fcbadb1e7d9a435ca6225d4bbe1d1a09b67d9ff509f76a378939b2de524d7ede73d0bebe2998cfb6957f110f64a052136815e1d5
-
Filesize
7KB
MD59013b8e6598fb96adf4132047df1805f
SHA1c01aba0f18f893a5098c234e7a06da13892ea68d
SHA256450df8dce189b2ad79f3c5b157a3083e6741c7740c970937d92609de4d4c211f
SHA512351e7d0c9a33a9abb93c786eb80f3619ef82815c287ce4fb41872b46ef6a733473e757a21954d0e0f09eb0d7d2bf54e46c93041dee6305097f47453b92d651e0
-
Filesize
7KB
MD59013b8e6598fb96adf4132047df1805f
SHA1c01aba0f18f893a5098c234e7a06da13892ea68d
SHA256450df8dce189b2ad79f3c5b157a3083e6741c7740c970937d92609de4d4c211f
SHA512351e7d0c9a33a9abb93c786eb80f3619ef82815c287ce4fb41872b46ef6a733473e757a21954d0e0f09eb0d7d2bf54e46c93041dee6305097f47453b92d651e0