Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 00:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe
-
Size
92KB
-
MD5
8eff2557176175b36f7dfbc96d66de7e
-
SHA1
c4bd1673a1b213eb76bd4d5585b458e89186ba5c
-
SHA256
29558b5b8abad441eff5491d4aab565d015fbb3bffc12560e8fd0988ca814b63
-
SHA512
7367a58c453db940e261a72b66e3c131eafe6885fc2fba04a782a963489875f99ddd6ea38e1193ebbc41d5ac6663d43981bb9776dee328783c2ffb5a26e3e3f1
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4Ak8ISyJOR6feBijpLOzECROmmX:ww+asqN5aW/hSDILJOaeB06Iz
Malware Config
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (699) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe" 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.strings.psd1.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBOB6.CHM 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.VisualBasic.Forms.dll 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-black.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_el.json 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\ui-strings.js.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main-selector.css.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hu-hu\ui-strings.js.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-private-l1-1-0.dll.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_altform-unplated_contrast-black.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOARIA.DLL.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Acrofx32.dll.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Formats.Asn1.dll 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ClassicPhotoAlbum.potx.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-64_altform-unplated.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_col.hxc 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks_heif.winmd 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ro-ro\ui-strings.js.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Locales\ml.pak.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\ui-strings.js.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\FileAssociation\FileAssociation.targetsize-48.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\es-419_get.svg 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Light.scale-200.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN054.XML.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-ppd.xrm-ms 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\ui-strings.js.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\virgo_mycomputer_folder_icon.svg.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\en_GB.aff.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\fr-FR\MSFT_PackageManagementSource.strings.psd1 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FlagToastQuickAction.scale-80.png 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Internet Explorer\it-IT\ieinstal.exe.mui 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationCore.resources.dll.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\large_trefoil_2x.png.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text_2x.gif.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ko-kr\ui-strings.js.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.id-A6E6444A.[[email protected]].arrow 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4948 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1728 vssvc.exe Token: SeRestorePrivilege 1728 vssvc.exe Token: SeAuditPrivilege 1728 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1496 wrote to memory of 5044 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 89 PID 1496 wrote to memory of 5044 1496 2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe 89 PID 5044 wrote to memory of 2592 5044 cmd.exe 91 PID 5044 wrote to memory of 2592 5044 cmd.exe 91 PID 5044 wrote to memory of 4948 5044 cmd.exe 92 PID 5044 wrote to memory of 4948 5044 cmd.exe 92 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_8eff2557176175b36f7dfbc96d66de7e_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2592
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4948
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4240 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:5952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-A6E6444A.[[email protected]].arrow
Filesize2.7MB
MD5805dad0e41ddd7a4fa6f600686d12932
SHA162022363af8a09e549932345981ba60bdc701cac
SHA256bf2e4bed22d1b7324d464599a90c4c8d3c34ec46f0e80a055af8c0f64e436bad
SHA512cbd488c513dcc9f2229fcdc41c168bdf63d53834fe514e665de6b794f9531a00d067e6fb75ce2252c3672b33c2cd02b6e607146ea53472c195e40e26eba9c518