Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe
-
Size
92KB
-
MD5
f0ab6743349f3ca9efc882a705ae09e8
-
SHA1
826e22f83d4ca23288dcf37994446c5a090edaf6
-
SHA256
0d341fcd44494bfa646ca60d3a88d7f8b42f7a7702c36fc7901efe7dd0535da8
-
SHA512
1ad9c28afbe776699c1dc83041f5a2084ccee197268eb073d57effc123ba2c1ec51e21da829c41a6a9b71034101e1c23df072766c16c72dcccd40755720d57d2
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4Auj5+JQHukINIrL3UxHcLL0zbTAw7Nh:ww+asqN5aW/hSI/H5INInUxH4IzP1J
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe" 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IF692Q5Y\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FA862KXF\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\P56GQFE8\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F5ZW0CRZ\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EY0DVRIO\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02757U.BMP.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBHD.DPV.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\macroprogress.gif.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02263_.WMF 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpg 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RESEND.CFG.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\7.png 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXC.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Address.accft.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECRECS.ICO 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\settings.css 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341499.JPG 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SLERROR.XML 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\Notebook03.onepkg.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09031_.WMF 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bogota.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183290.WMF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292272.WMF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTES.ICO 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libupnp_plugin.dll 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\picturePuzzle.html 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172067.WMF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115865.GIF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR45B.GIF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libexport_plugin.dll.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGN.CFG 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34B.GIF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44F.GIF 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT98.POC.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237225.WMF.id-9B431273.[[email protected]].ROGER 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2556 vssadmin.exe 2708 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2740 vssvc.exe Token: SeRestorePrivilege 2740 vssvc.exe Token: SeAuditPrivilege 2740 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2036 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 28 PID 2620 wrote to memory of 2036 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 28 PID 2620 wrote to memory of 2036 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 28 PID 2620 wrote to memory of 2036 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 28 PID 2036 wrote to memory of 2744 2036 cmd.exe 30 PID 2036 wrote to memory of 2744 2036 cmd.exe 30 PID 2036 wrote to memory of 2744 2036 cmd.exe 30 PID 2036 wrote to memory of 2556 2036 cmd.exe 31 PID 2036 wrote to memory of 2556 2036 cmd.exe 31 PID 2036 wrote to memory of 2556 2036 cmd.exe 31 PID 2620 wrote to memory of 3844 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 35 PID 2620 wrote to memory of 3844 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 35 PID 2620 wrote to memory of 3844 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 35 PID 2620 wrote to memory of 3844 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 35 PID 3844 wrote to memory of 1620 3844 cmd.exe 37 PID 3844 wrote to memory of 1620 3844 cmd.exe 37 PID 3844 wrote to memory of 1620 3844 cmd.exe 37 PID 3844 wrote to memory of 2708 3844 cmd.exe 38 PID 3844 wrote to memory of 2708 3844 cmd.exe 38 PID 3844 wrote to memory of 2708 3844 cmd.exe 38 PID 2620 wrote to memory of 3776 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 39 PID 2620 wrote to memory of 3776 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 39 PID 2620 wrote to memory of 3776 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 39 PID 2620 wrote to memory of 3776 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 39 PID 2620 wrote to memory of 2100 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 40 PID 2620 wrote to memory of 2100 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 40 PID 2620 wrote to memory of 2100 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 40 PID 2620 wrote to memory of 2100 2620 2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_f0ab6743349f3ca9efc882a705ae09e8_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2744
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2556
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1620
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2708
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3776
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2100
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-9B431273.[[email protected]].ROGER
Filesize23.5MB
MD5dd2fb480a3a0146c75dc40037e888b9f
SHA14524ba72136892a579de1d46c87a213c96940492
SHA256f9aec25049aebe0aec53b50229839d0329967c448b52b510a4e75cb9474a0669
SHA5129ace84a7141a21984293945829cc125703850bde206a475342c481b1dc364ff4bf1e2ba29bc0b2986e12811cea07d753b286e4f8d04fdb0ad5776e52180c7c0e
-
Filesize
7KB
MD57c5a870265ea6c6dc19b09e954d25532
SHA1e0bdda2d378f7ba2f509e74f52e2321d11db790b
SHA256764f39325035a29739fee39a3cde8c36eec41a1d3fcb6e0e8ec7718f9452b185
SHA512e4791a468976b4cabec291254f168ccb96c02d01f04b949148c40429b2c72504687227ba85c6e48c04dea64399c75667e0e3668d46530b92c4d068bdfd34d4f1