Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe
-
Size
92KB
-
MD5
3218917a67a4139acc428caf5ff9ccc5
-
SHA1
460e0278ba8e4cb904587944c1da76437e102360
-
SHA256
ab609c34aa4646384c6c0d9b37abda0e4eb9781d488cf5f6903c341c47d7dbc1
-
SHA512
4fd5ea55704d932196e1d759eb718afe5f2e913e35296b1c520bb65c5a5431ea5b7fce5ef9a8379ec0e91344c4542359570f05d7c43a6093abe1d676ad9c7e80
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4AHeAzVbobr+t+NK1GcoDc50cO2tqpbe:ww+asqN5aW/hSUUVEnHKIcAtcO2tqpb
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (313) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe" 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AS4I30IR\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1OEGTYQG\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LS99WIMF\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2Y0HPGOE\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BB0Z8TKM\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WZPJ6IGS\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JP38OXIN\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewDblClick.js.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107266.WMF 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\dnsns.jar.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\common.js.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETSM.WMF 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS11.POC 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\bin\libxslt.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libedummy_plugin.dll 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\meta-index 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGHEADING.XML.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME29.CSS 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01954_.WMF 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libsmb_plugin.dll 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01840_.GIF.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\bin\wsdetect.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01164_.WMF.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00212_.WMF.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00289_.WMF 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_COL.HXC.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297185.WMF 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02126_.WMF.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21370_.GIF 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\PASSWORD.JPG.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00177_.WMF.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239079.WMF.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRLEX.DLL 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG.id-11C157B4.[[email protected]].data 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1132 vssadmin.exe 2324 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2216 vssvc.exe Token: SeRestorePrivilege 2216 vssvc.exe Token: SeAuditPrivilege 2216 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2948 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 28 PID 2200 wrote to memory of 2948 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 28 PID 2200 wrote to memory of 2948 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 28 PID 2200 wrote to memory of 2948 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 28 PID 2948 wrote to memory of 2804 2948 cmd.exe 30 PID 2948 wrote to memory of 2804 2948 cmd.exe 30 PID 2948 wrote to memory of 2804 2948 cmd.exe 30 PID 2948 wrote to memory of 1132 2948 cmd.exe 31 PID 2948 wrote to memory of 1132 2948 cmd.exe 31 PID 2948 wrote to memory of 1132 2948 cmd.exe 31 PID 2200 wrote to memory of 1676 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 37 PID 2200 wrote to memory of 1676 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 37 PID 2200 wrote to memory of 1676 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 37 PID 2200 wrote to memory of 1676 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 37 PID 1676 wrote to memory of 3012 1676 cmd.exe 39 PID 1676 wrote to memory of 3012 1676 cmd.exe 39 PID 1676 wrote to memory of 3012 1676 cmd.exe 39 PID 1676 wrote to memory of 2324 1676 cmd.exe 40 PID 1676 wrote to memory of 2324 1676 cmd.exe 40 PID 1676 wrote to memory of 2324 1676 cmd.exe 40 PID 2200 wrote to memory of 1660 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 41 PID 2200 wrote to memory of 1660 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 41 PID 2200 wrote to memory of 1660 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 41 PID 2200 wrote to memory of 1660 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 41 PID 2200 wrote to memory of 2820 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 42 PID 2200 wrote to memory of 2820 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 42 PID 2200 wrote to memory of 2820 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 42 PID 2200 wrote to memory of 2820 2200 2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe 42 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_3218917a67a4139acc428caf5ff9ccc5_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2804
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1132
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3012
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2324
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:1660
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2820
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-11C157B4.[[email protected]].data
Filesize23.5MB
MD5bcca6e3c44872a5b19ee56546e9cc704
SHA1de84072b7b0f3de1e90830a3e36f0617dddb5979
SHA256d0ab9682c779df55c83089206872ad2aa473d0b0f7d975e975253486adddbb85
SHA512cc995f6435af014de8410962c676af8b67fe870d7e1c677c6ba126239e38a7782a23d856d2171b95750ae8b61d59906920340d4047dbc1490e1430dd016e42a3
-
Filesize
7KB
MD5540fb6787deabee06ebb2e1d4db9e98d
SHA1893d858a27f069bbc74f6b5eba24e6397d718a93
SHA256bda026d239d32c5f14e3ae06e10d7a8d9ee26096f68e2b31dfb91b3206492973
SHA512438e44bca73f75278b2ef1c57ce74d508f01ac1ff33fb0cd170aec5ccd5b303e8da030ed1cadf5112daf584cf61be1d2a8b39708c0b867072d1e66d7ab83b90b