Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/06/2024, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe
-
Size
92KB
-
MD5
ecb9ce512c87d71d88144ad64f5abfd8
-
SHA1
0cde37bd2c0aaa35b59bf910e5dbc9cf60f9e44c
-
SHA256
f8f68990fd52ffe979ab4b7fb95658c7e914c8d2f0bc4b71c23193bdfdd984e8
-
SHA512
6119ff932ef73de20215a4fad54f146ce20e63e51df0df2f874cb0646d17d1c2c157f9e453dbf310d3de05ffbe7a27515d87980016daed655e0bcc58745454d0
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4AlBQbr5bYH+J4jS0B:ww+asqN5aW/hSVQv5+B
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe" 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\1PJQWC5P\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YK6DYF6H\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SZUP0XFR\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N2LZJYLW\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SK0QRJKA\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Windows\System32\Info.hta 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libcache_block_plugin.dll 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSSOAPR3.DLL.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\RevokeSend.3g2.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWCUTCHR.DLL.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10301_.GIF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Moncton.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.DPV.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_F_COL.HXK 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE06049_.WMF 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14529_.GIF 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18254_.WMF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10267_.GIF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR16F.GIF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\bin\splashscreen.dll 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALSO11.POC.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SPANISH.LNG.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\America\Barbados.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\MCABOUT.HTM 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MP00646_.WMF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198372.WMF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.INF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files\7-Zip\Lang\ug.txt.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115855.GIF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00345_.WMF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01299_.GIF.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\SUBMIT.JS.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer.id-EF696E2A.[[email protected]].bot 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.XML 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2248 vssadmin.exe 2472 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 2448 vssvc.exe Token: SeRestorePrivilege 2448 vssvc.exe Token: SeAuditPrivilege 2448 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1744 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 28 PID 2036 wrote to memory of 1744 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 28 PID 2036 wrote to memory of 1744 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 28 PID 2036 wrote to memory of 1744 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 28 PID 1744 wrote to memory of 2720 1744 cmd.exe 30 PID 1744 wrote to memory of 2720 1744 cmd.exe 30 PID 1744 wrote to memory of 2720 1744 cmd.exe 30 PID 1744 wrote to memory of 2248 1744 cmd.exe 31 PID 1744 wrote to memory of 2248 1744 cmd.exe 31 PID 1744 wrote to memory of 2248 1744 cmd.exe 31 PID 2036 wrote to memory of 3176 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 35 PID 2036 wrote to memory of 3176 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 35 PID 2036 wrote to memory of 3176 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 35 PID 2036 wrote to memory of 3176 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 35 PID 3176 wrote to memory of 2900 3176 cmd.exe 37 PID 3176 wrote to memory of 2900 3176 cmd.exe 37 PID 3176 wrote to memory of 2900 3176 cmd.exe 37 PID 3176 wrote to memory of 2472 3176 cmd.exe 38 PID 3176 wrote to memory of 2472 3176 cmd.exe 38 PID 3176 wrote to memory of 2472 3176 cmd.exe 38 PID 2036 wrote to memory of 2280 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 39 PID 2036 wrote to memory of 2280 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 39 PID 2036 wrote to memory of 2280 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 39 PID 2036 wrote to memory of 2280 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 39 PID 2036 wrote to memory of 1836 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 40 PID 2036 wrote to memory of 1836 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 40 PID 2036 wrote to memory of 1836 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 40 PID 2036 wrote to memory of 1836 2036 2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe 40 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_ecb9ce512c87d71d88144ad64f5abfd8_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2720
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2248
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2900
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2472
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2280
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:1836
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id-EF696E2A.[[email protected]].bot
Filesize24.4MB
MD530eddfc4484e463fd3e42bc505aa7237
SHA11cec211ead7c43e47f9fd87ec5ecc3d3469a0d2d
SHA25682b0688a1fd209471b3c540f80161c9c51bc22d644d88b44ad40860303c39f1b
SHA512a8bbc8f3c26aa105af417312cce748c57403121b9777b40922cfffec3517d2dacb6879cb677c103785c49d98b2c0c5c81345271a47885ab1fabcaaddf29c3e6b
-
Filesize
13KB
MD5bfc985101e8d6d1a379c45c979279a38
SHA1b85001c21f71272163edf4e085090bf8f4fd60fc
SHA2562a0c5a0d5871c29ce00affba0aef5f9b0395d98a044ca33877cd8f8e484f0dd1
SHA5124e3bb9dfa792cd878d3d867060bb95d282b182acece7af5f934df779a01b2bbf4cb0dd4fffca9b0c2e3cbc4a0b16cf3a2ae4456c37ea8224082e28810ddebad5