Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe
-
Size
92KB
-
MD5
22801c2a771739edf1d492dc91fbcba1
-
SHA1
d59c8719dfff6a2d33c779fdd02f78b3d9d70394
-
SHA256
c4a8ffe8e2c084ae73ba036876818be66ed219a5353aa7b98f725e5a22c87971
-
SHA512
d8f1db870aa9f60eef231d97116b24f344e722616aab4a623f77ef35987c59dd67eb2cb701ea6755117f65e94b5dbb3e08d34dbc48fb7d19771e90fbaa921821
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4Ap4cEVQdFPbCBbtO0K/qkroB5eWq2lL:ww+asqN5aW/hSYV2FPbKO0K/qk0cX2R
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (343) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe" 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jvisualvm.txt.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\MedTile.scale-100.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG2.TTF.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_gridview_selected-hover.svg 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\ui-strings.js 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-24_altform-unplated.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\cs-cz\ui-strings.js.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.FileUtils.dll.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\ui-strings.js.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailSmallTile.scale-400.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\ui-strings.js.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Linq.dll.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre-1.8\README.txt.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.SqlDatabase.dll.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\WindowsBase.resources.dll 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\SearchEmail.png.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.DLL 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ru-ru\ui-strings.js 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\custom_poster.png.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.PerformanceCounter.dll.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\171.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RICHED20.DLL.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\networkmanifest.xml 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\PIXEL.ELM.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\ui-strings.js 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-200.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-200.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\THMBNAIL.PNG.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\digsig_icons_2x.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\ui-strings.js.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\THMBNAIL.PNG.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48_altform-unplated.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_start_a_coversation_v2.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-unplated.png 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\MissingAlbumArt.jpg 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\THMBNAIL.PNG.id-1E87E2A3.[[email protected]].bip 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\6.jpg 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1460 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1968 vssvc.exe Token: SeRestorePrivilege 1968 vssvc.exe Token: SeAuditPrivilege 1968 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2960 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 91 PID 2112 wrote to memory of 2960 2112 2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe 91 PID 2960 wrote to memory of 220 2960 cmd.exe 93 PID 2960 wrote to memory of 220 2960 cmd.exe 93 PID 2960 wrote to memory of 1460 2960 cmd.exe 94 PID 2960 wrote to memory of 1460 2960 cmd.exe 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_22801c2a771739edf1d492dc91fbcba1_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:220
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1460
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:1224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-1E87E2A3.[[email protected]].bip
Filesize3.2MB
MD5c9c8724dbb65e00e8c8c3b81074b0795
SHA16d7b15fd81758d0b197af7d43a9c59bac9a6f0df
SHA256ad1afb1f70d21f7aaa57af3ef1b6a9329f7081cf4a744403822dd403e1712786
SHA512b7c8fe7f453df2aa4e8b5ec842923602208416861371328ab40c404a4bc38f753302a51a233754d77f3fc80338306575420059fa47b611a7528791d60b4cfb57