Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 02:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe
-
Size
92KB
-
MD5
dff72ddc745929160ea5f725aecf2460
-
SHA1
54a73d8a9c8c435f23789c5d98a31e27ffe21ac2
-
SHA256
6d5d20215c64f189add3d76f6c2efc5f4ac4176ccf74a33e527f00c5f36793b5
-
SHA512
d604b1400e1bbb43d4befe36710449f14067da11e68d9d46c621417b2732de0bba04768b62ea3d1789095e717752339c1e8b898dea1c53747a4762a3138b50cd
-
SSDEEP
1536:mBwl+KXpsqN5vlwWYyhY9S4AndTS2KdAHo3XJ+y+fDDQtT/GF:Qw+asqN5aW/hL1dTaJ3Xt+UTu
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Dec24hepl@aol.com
Dec24hepl@cyberfear.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (500) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe -
Drops startup file 5 IoCs
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe = "C:\\Windows\\System32\\2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe" 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3803511929-1339359695-2191195476-1000\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exedescription ioc process File created C:\Windows\System32\2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-100.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fi-fi\ui-strings.js.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Entities 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-125.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ui-strings.js 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\IMCONTACT.DLL.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\th.pak.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-100_contrast-black.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\31.jpg 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoSearchResults_180x160.svg 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\example_icons.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XPath.XDocument.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-3.jpg 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInAcrobat.gif 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks_VP9.winmd 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White@3x.png.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-tw\ui-strings.js.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\bg.pak.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.Classic.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\LargeTile.scale-125.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\vi_get.svg 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\PSReadline.psm1.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\EQ_ThumbShadow.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\69.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\load-typekit.js.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Mozilla Firefox\ipcclientcerts.dll 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\mscordbi.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-400.png 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.id-B091180F.[Dec24hepl@aol.com].SYSDF 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 5968 vssadmin.exe 1180 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exepid process 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1512 vssvc.exe Token: SeRestorePrivilege 1512 vssvc.exe Token: SeAuditPrivilege 1512 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.execmd.execmd.exedescription pid process target process PID 752 wrote to memory of 4936 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe cmd.exe PID 752 wrote to memory of 4936 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe cmd.exe PID 4936 wrote to memory of 4912 4936 cmd.exe mode.com PID 4936 wrote to memory of 4912 4936 cmd.exe mode.com PID 4936 wrote to memory of 5968 4936 cmd.exe vssadmin.exe PID 4936 wrote to memory of 5968 4936 cmd.exe vssadmin.exe PID 752 wrote to memory of 11220 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe cmd.exe PID 752 wrote to memory of 11220 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe cmd.exe PID 11220 wrote to memory of 3572 11220 cmd.exe mode.com PID 11220 wrote to memory of 3572 11220 cmd.exe mode.com PID 11220 wrote to memory of 1180 11220 cmd.exe vssadmin.exe PID 11220 wrote to memory of 1180 11220 cmd.exe vssadmin.exe PID 752 wrote to memory of 7700 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe mshta.exe PID 752 wrote to memory of 7700 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe mshta.exe PID 752 wrote to memory of 7932 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe mshta.exe PID 752 wrote to memory of 7932 752 2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_dff72ddc745929160ea5f725aecf2460_crysis_dharma.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con cp select=12513⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B091180F.[Dec24hepl@aol.com].SYSDFFilesize
1.4MB
MD5d635a0115766a70a4f8fb36b3604542c
SHA1f1e97281ff5088e93b448b63c6c9bf9139d18699
SHA256b2b7e6fbcf40759e700e0c0f850fb9fa68e44637e37ece0c38c2e91608dc0580
SHA51248f1c86396fb631bb8c54f728adcd5b97e066f4056d75edee2185640fc4e8486978d3be0b71852270ac3340096123b86d0a458f1a7d071227a910687cd967728
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD54ad9d13dbe6ab84bef221d11283258fd
SHA1fd3526791e69d45542f246384bbaadc8a942ef6d
SHA256bee7377276930afe577ef77c49e4b3d90f7c537a566235bd816ed1163846fafc
SHA5124eea21f6f0df7d370c00675fdb0a481dd269be3761220d8065b6871a3898016c8b31f6440aa952c347c2f6968144292db05ecd8952606936e5e79126f5b3bf00