Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe
-
Size
92KB
-
MD5
10c8fcc69cae51ca05bae40be9fa4f89
-
SHA1
68005a698cfe96e19128e8b83d975657d8354f56
-
SHA256
141f975530b35619b0e8b997737302ee462f4451ce2a32d826265d583a058c70
-
SHA512
2a2f75c2f614b4583ae062d555ce855ff478c8843b6e2f5179947472ee7de360dac370030202ba26aaa320bc1cc05eb023215fe3d7a4ed4d0a94e7f22cb2a8aa
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4A2MNXbcYAtIt83a+KX3SJ7zcI:ww+asqN5aW/hS0MNIZaD3SRb
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe" 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlOuterCircle.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\System\ja-JP\wab32res.dll.mui 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft\Edge\Edge.dat.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-100.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsSplashLogo.scale-180.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\javascript_poster.jpg.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_is.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DropboxStorage.api 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Dark.scale-125.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\de\Microsoft.PackageManagement.resources.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.Advertising.winmd 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-100.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main.css.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\fr\Microsoft.PackageManagement.resources.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\en-US.PostalAddress.model 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppStoreLogo.scale-200.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-150.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-57x57-precomposed.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\selector.js 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-100.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\SearchEmail.png.id-C6991D44.[[email protected]].payB 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\PRNDMediaSource.dll 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1824 vssadmin.exe 6708 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 5408 vssvc.exe Token: SeRestorePrivilege 5408 vssvc.exe Token: SeAuditPrivilege 5408 vssvc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4684 wrote to memory of 2260 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 80 PID 4684 wrote to memory of 2260 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 80 PID 2260 wrote to memory of 3888 2260 cmd.exe 82 PID 2260 wrote to memory of 3888 2260 cmd.exe 82 PID 2260 wrote to memory of 1824 2260 cmd.exe 83 PID 2260 wrote to memory of 1824 2260 cmd.exe 83 PID 4684 wrote to memory of 8016 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 87 PID 4684 wrote to memory of 8016 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 87 PID 8016 wrote to memory of 5324 8016 cmd.exe 89 PID 8016 wrote to memory of 5324 8016 cmd.exe 89 PID 8016 wrote to memory of 6708 8016 cmd.exe 90 PID 8016 wrote to memory of 6708 8016 cmd.exe 90 PID 4684 wrote to memory of 6980 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 91 PID 4684 wrote to memory of 6980 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 91 PID 4684 wrote to memory of 7332 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 92 PID 4684 wrote to memory of 7332 4684 2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe 92 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_10c8fcc69cae51ca05bae40be9fa4f89_crysis_dharma.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3888
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1824
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:8016 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:5324
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6708
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:6980
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵PID:7332
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-C6991D44.[[email protected]].payB
Filesize2.9MB
MD50e8d9c44837c2ac091c6709dab926bea
SHA1012f7b985dd4e01a112f7fd6daa92d6d44426de8
SHA25676232dc04855574455b54daf3ce1dcdf38757878ed2c7e58ae958be6ac2ff61c
SHA5120345550e492a2f9f5eec43e6f617ba0a613a4fd709a043671149040a6f7d71d6f401e75f49edd3b863a47f5d2b97ab43db6d2f4224178f739accd977b597312e
-
Filesize
7KB
MD5c04b343e52a449368853122ac17bda4b
SHA1256fb88bff5c0cc2fa4f2dcb5cd7a085c0e17e0d
SHA256a67513036a5be10c3e6b6b080266b4d8282a741eedbf557e3adebcf326014f6a
SHA512683fd4bce436447afa50fdbcdf1d91d194016d6044698b78645521d5fce5818f3a0495ae38bee5684177b52db0721a3332d4f414dafd891127c7b5cf872667f9