Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 14:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe
-
Size
92KB
-
MD5
696a63ef620b7144d96d623ced6cb6f1
-
SHA1
c1083d0befdafe3258b2a790d826b9be52c91b14
-
SHA256
aefe553b2bca2136b54334085f5073123d2d9406d4b3719ca1a54a6bbfe3aecf
-
SHA512
f7a69680b2bbaa80605f2f2e5628aaf7e54c79140fa61da258aa81af87578b8be2794729b6b0eac63922d771b8d89ab50597d1e49fee3997e5d2c2864a9d7979
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4AiVMbXwOstfc/EqcKBxAvhzvcR:ww+asqN5aW/hSRwOstcMqckeK
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
backmydata@protonmail.com
backmydata@airmail.cc
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe" 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NNULH633\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OQAMAYIL\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\M221U1AY\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5VY10BSW\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HL1JTUOY\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\KEQD8ZAD\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\jce.jar 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02503U.BMP 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Casual.gif.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105332.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00190_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14711_.GIF 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00998_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10254_.GIF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15273_.GIF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03241_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroSign.prc.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME22.CSS 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwgl_plugin.dll.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME01.CSS.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8B.GIF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.OPG 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03339_.WMF 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\BCSStr32.dll.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00018_.WMF 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00217_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46B.GIF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL044.XML.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\THMBNAIL.PNG.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18180_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18253_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAClientPkgUI.dll 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\bin\deploy.dll 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SUMER_01.MID.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19986_.WMF.id-11144903.[backmydata@protonmail.com].bmd 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3796 vssadmin.exe 2732 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1052 vssvc.exe Token: SeRestorePrivilege 1052 vssvc.exe Token: SeAuditPrivilege 1052 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2792 wrote to memory of 1252 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 28 PID 2792 wrote to memory of 1252 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 28 PID 2792 wrote to memory of 1252 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 28 PID 2792 wrote to memory of 1252 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 28 PID 1252 wrote to memory of 2584 1252 cmd.exe 30 PID 1252 wrote to memory of 2584 1252 cmd.exe 30 PID 1252 wrote to memory of 2584 1252 cmd.exe 30 PID 1252 wrote to memory of 2732 1252 cmd.exe 31 PID 1252 wrote to memory of 2732 1252 cmd.exe 31 PID 1252 wrote to memory of 2732 1252 cmd.exe 31 PID 2792 wrote to memory of 3704 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 35 PID 2792 wrote to memory of 3704 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 35 PID 2792 wrote to memory of 3704 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 35 PID 2792 wrote to memory of 3704 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 35 PID 3704 wrote to memory of 3780 3704 cmd.exe 37 PID 3704 wrote to memory of 3780 3704 cmd.exe 37 PID 3704 wrote to memory of 3780 3704 cmd.exe 37 PID 3704 wrote to memory of 3796 3704 cmd.exe 38 PID 3704 wrote to memory of 3796 3704 cmd.exe 38 PID 3704 wrote to memory of 3796 3704 cmd.exe 38 PID 2792 wrote to memory of 3768 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 39 PID 2792 wrote to memory of 3768 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 39 PID 2792 wrote to memory of 3768 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 39 PID 2792 wrote to memory of 3768 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 39 PID 2792 wrote to memory of 3860 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 40 PID 2792 wrote to memory of 3860 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 40 PID 2792 wrote to memory of 3860 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 40 PID 2792 wrote to memory of 3860 2792 2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_696a63ef620b7144d96d623ced6cb6f1_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2584
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2732
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3780
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3796
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3768
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3860
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-11144903.[backmydata@protonmail.com].bmd
Filesize23.5MB
MD5787565533ef679c6114a4a309eba3f1a
SHA1262364c0fd7f6314b2872469cb9576ebba80d0ad
SHA256bdcd8e9da5e7673d5c9b651e3017146ddf4ac4db6d31d9e9c870cd998837b62c
SHA51270723261be9d56bdae83acda0639066d43fbc4418b1271b59acfa07a3577aa18be736a7c4cf6544c2bfbed49ad976a184ec10d4098c07e6ce0983190356b02c8
-
Filesize
7KB
MD53b9450624404687ad0aa58a91c23862f
SHA15ccdee49f0f347e3b822a69166a953bda6771214
SHA256592514762d036f8a946e19bb106918a6e719fe202262ca803c6fcc2c8931bb35
SHA51204227c28bf932488fdad0749153809eda355c6b39780aef3b560d24d9e65500c436bd558840e0f566a9910cf838c991f68ae916866042fdb9ad4da1569eb6a8b