Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe
-
Size
92KB
-
MD5
e7336fd4620b673218b73b52d3d359f4
-
SHA1
ea64c1177ca3cd54a906a7a3ed93efb140305e5f
-
SHA256
19cd6b2b765dae01da69b7070b96551a14237ea1b0192bb8282e76af07bef6ae
-
SHA512
162d709c280ffd76a4482e1cab5c5609cbee0d547a13af6f6f7d086b193351d60136e7129c3e7de633335f93bd0a970982ad3446b27cb2e2c29325bb7e34783e
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4A3CnBt8WKuKZLlKYy2lsC:ww+asqN5aW/hSFEX8WKuulvyKsC
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe" 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EQ2PZD61\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HUNEJ1HU\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MG62UP6H\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BB4W7M7Z\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2RM92H5V\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6UZVS19T\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A9XVYA91\desktop.ini 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\excelcnvpxy.dll.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ACE.dll 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\COMPASS.INF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee90.tlb.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Brussels 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292248.WMF 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04323_.WMF 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297757.WMF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\POLICIES.FDT 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0292020.WMF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_uk.dll 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ACCVDTUI.DLL.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14845_.GIF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\VIEW.JS 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02423_.WMF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OIS_F_COL.HXK.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Media Player\WMPDMCCore.dll 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files\7-Zip\Lang\io.txt.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Mozilla Firefox\softokn3.dll.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01130_.WMF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200611.WMF 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_ON.GIF 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NAVBAR11.POC.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21304_.GIF 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\SketchPadTestSchema.xml.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382961.JPG.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14515_.GIF.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00305_.WMF 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid.gif.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\meta-index 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.DLL.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santiago 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\MST7 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll.id-4EED20DD.[[email protected]].DELTA 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2596 vssadmin.exe 1880 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1584 vssvc.exe Token: SeRestorePrivilege 1584 vssvc.exe Token: SeAuditPrivilege 1584 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2252 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 28 PID 2020 wrote to memory of 2252 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 28 PID 2020 wrote to memory of 2252 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 28 PID 2020 wrote to memory of 2252 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 28 PID 2252 wrote to memory of 2888 2252 cmd.exe 30 PID 2252 wrote to memory of 2888 2252 cmd.exe 30 PID 2252 wrote to memory of 2888 2252 cmd.exe 30 PID 2252 wrote to memory of 2596 2252 cmd.exe 31 PID 2252 wrote to memory of 2596 2252 cmd.exe 31 PID 2252 wrote to memory of 2596 2252 cmd.exe 31 PID 2020 wrote to memory of 3984 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 35 PID 2020 wrote to memory of 3984 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 35 PID 2020 wrote to memory of 3984 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 35 PID 2020 wrote to memory of 3984 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 35 PID 3984 wrote to memory of 412 3984 cmd.exe 37 PID 3984 wrote to memory of 412 3984 cmd.exe 37 PID 3984 wrote to memory of 412 3984 cmd.exe 37 PID 3984 wrote to memory of 1880 3984 cmd.exe 38 PID 3984 wrote to memory of 1880 3984 cmd.exe 38 PID 3984 wrote to memory of 1880 3984 cmd.exe 38 PID 2020 wrote to memory of 2784 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 39 PID 2020 wrote to memory of 2784 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 39 PID 2020 wrote to memory of 2784 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 39 PID 2020 wrote to memory of 2784 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 39 PID 2020 wrote to memory of 3096 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 40 PID 2020 wrote to memory of 3096 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 40 PID 2020 wrote to memory of 3096 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 40 PID 2020 wrote to memory of 3096 2020 2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_e7336fd4620b673218b73b52d3d359f4_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2888
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2596
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:412
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1880
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2784
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3096
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52a5fe25f3cd4651134b6d26f5f287d27
SHA10ce953e3610460ba76d2a480baf73bc7d9363b19
SHA2568db3d398605c51ea415384c87ea19dc82f05fbe240847451fa1196944280e861
SHA512e83e64170248deabffb93e68865d568235cfb602d6fdf4b156d980b3cb72a426edb44bf84420190a5e4fdcc474b2913d8c9f1cdc820c00ad9e0141cb86d7678e