Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 19:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe
-
Size
92KB
-
MD5
e1992567a81c254b849db30c7af437b8
-
SHA1
913223f7da311250baccba0adca61670216d41bd
-
SHA256
884eb9b2819fd2d1a2835e1573e8f2bf8e0406df5fac189b2694ade397a480ff
-
SHA512
58dd2390d64a7a9172c8720ee1ae52d2c8551c253e8d68a19935c3f4bc0d8906c76516610cf3fc0b183b4de241807820d6269f40f3cbc47c3a0a2c8021f425ce
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4AurqsLrK0OAFHGpQMAOHC5viuVErCTb:ww+asqN5aW/hSuTNHGpQjOilNuC/
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (310) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
Processes:
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe" 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F9UL0C6O\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LGZQH3SP\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\108YEMNS\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3J2LRC5A\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\J3XTYXPF\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JYWEBS5E\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CYTS71XD\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
Processes:
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exedescription ioc process File created C:\Windows\System32\2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR31F.GIF 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Sts.css 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\PREVIEW.GIF 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEMS.ICO.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301432.WMF 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Country.css.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN089.XML 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Journal\Templates\Genko_1.jtp 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115868.GIF.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182689.JPG.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185796.WMF.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02466U.BMP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Issue Tracking.gta.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\ARROW.WAV.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\bin\nio.dll.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14795_.GIF.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115863.GIF.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImagesMask.bmp 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files\7-Zip\Lang\da.txt.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\PREVIEW.GIF 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libspdif_plugin.dll 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL002.XML.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01130_.WMF 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\wmpnssci.dll.mui 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\mip.exe.mui 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15136_.GIF.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\CHICAGO.XSL.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285484.WMF 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\SUBMIT.JS.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\cursors.properties 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\FM20.CHM 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Detroit 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.XML 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107138.WMF.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar.id-8032C113.[[email protected]].WSHLP 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2460 vssadmin.exe 1676 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exepid process 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1476 vssvc.exe Token: SeRestorePrivilege 1476 vssvc.exe Token: SeAuditPrivilege 1476 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.execmd.execmd.exedescription pid process target process PID 2160 wrote to memory of 2488 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 2160 wrote to memory of 2488 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 2160 wrote to memory of 2488 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 2160 wrote to memory of 2488 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 2488 wrote to memory of 2620 2488 cmd.exe mode.com PID 2488 wrote to memory of 2620 2488 cmd.exe mode.com PID 2488 wrote to memory of 2620 2488 cmd.exe mode.com PID 2488 wrote to memory of 1676 2488 cmd.exe vssadmin.exe PID 2488 wrote to memory of 1676 2488 cmd.exe vssadmin.exe PID 2488 wrote to memory of 1676 2488 cmd.exe vssadmin.exe PID 2160 wrote to memory of 3808 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 2160 wrote to memory of 3808 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 2160 wrote to memory of 3808 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 2160 wrote to memory of 3808 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe cmd.exe PID 3808 wrote to memory of 4004 3808 cmd.exe mode.com PID 3808 wrote to memory of 4004 3808 cmd.exe mode.com PID 3808 wrote to memory of 4004 3808 cmd.exe mode.com PID 3808 wrote to memory of 2460 3808 cmd.exe vssadmin.exe PID 3808 wrote to memory of 2460 3808 cmd.exe vssadmin.exe PID 3808 wrote to memory of 2460 3808 cmd.exe vssadmin.exe PID 2160 wrote to memory of 3076 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe PID 2160 wrote to memory of 3076 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe PID 2160 wrote to memory of 3076 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe PID 2160 wrote to memory of 3076 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe PID 2160 wrote to memory of 4040 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe PID 2160 wrote to memory of 4040 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe PID 2160 wrote to memory of 4040 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe PID 2160 wrote to memory of 4040 2160 2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_e1992567a81c254b849db30c7af437b8_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2620
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1676 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:4004
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2460 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3076 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:4040
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.id-8032C113.[[email protected]].WSHLPFilesize
3.6MB
MD5a4b5b816a1fb133af356a2bfb4101f43
SHA110b1163be3b14dc1cc9840e1549b56e4eff54f2d
SHA256a207f6181551ad5b4c71e6058e2af56b78b2b7aee92c204975b89a3b024b3635
SHA5123911ca24560791a38de1dc1dbd1ad555c037cf7338b988bdd9a7a19f477b07a63dd49d7f50a7ec2b802fb877bd930e9db2f504963fb2dd3caa7a662831384104
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.htaFilesize
7KB
MD55ae7d45a4f05eff90e7b77ccd3b31cad
SHA190d56fb0df403bae51a50650518c637ce4e295de
SHA256614c5b4e051e740da248b95c7c948edca21eb8515b5f34ac1cbdf7193a2a9da6
SHA5129046051984108e4485c1003a58daf7e3df853c215bcb81fbb704d8b67ad5783c4e3ca95b2d6f0d6c7936fbe29fa60fd1851f26a0a11981af38bc3db457dbb849