Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 14:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe
-
Size
92KB
-
MD5
2d3611a415d4b904c601df5174b3957f
-
SHA1
ff2fce545a267557ef59089c76ea69d495ad5b44
-
SHA256
9ce3759793f56b547c9b5d683d922cd7691c79e337ba8478c9757b5836ae71c5
-
SHA512
05ad2d269079268836e1be0d13d8927ad053faa0ebbc86ba6aa18dd8a916df1d136d5908db5d0e2fd1f0c4f20f915154b6b76c6780b9352679e9346b70567e2e
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4AKKMgZBBz3fbzhr9t/HO:ww+asqN5aW/hSjD9p
Malware Config
Extracted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
cry777@tutanota.com
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (312) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe" 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Y8NTX1F\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9PLWLLW7\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\X7K1QVVO\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\03PVXV8P\desktop.ini 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\Info.hta 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Windows\System32\2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152884.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01218_.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.ELM 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00256_.WMF 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.XML.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285484.WMF 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendtoOneNoteFilter.gpd 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\THMBNAIL.PNG.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01661_.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02022_.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN090.XML.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.security 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLWVW.DLL.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL090.XML.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_K_COL.HXK.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_fr.dub.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmjpeg_plugin.dll.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00352_.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msaddsr.dll 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\msadcs.dll 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232797.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jpeg.dll.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14691_.GIF 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151061.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\ja-JP\Minesweeper.exe.mui.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02400_.WMF 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HEADER.GIF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSYUBIN7.DLL.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\tipresx.dll 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF.id-516B9330.[cry777@tutanota.com].arena 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2900 vssadmin.exe 760 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1656 vssvc.exe Token: SeRestorePrivilege 1656 vssvc.exe Token: SeAuditPrivilege 1656 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2408 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 28 PID 1848 wrote to memory of 2408 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 28 PID 1848 wrote to memory of 2408 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 28 PID 1848 wrote to memory of 2408 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 28 PID 2408 wrote to memory of 1536 2408 cmd.exe 30 PID 2408 wrote to memory of 1536 2408 cmd.exe 30 PID 2408 wrote to memory of 1536 2408 cmd.exe 30 PID 2408 wrote to memory of 2900 2408 cmd.exe 31 PID 2408 wrote to memory of 2900 2408 cmd.exe 31 PID 2408 wrote to memory of 2900 2408 cmd.exe 31 PID 1848 wrote to memory of 2880 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 34 PID 1848 wrote to memory of 2880 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 34 PID 1848 wrote to memory of 2880 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 34 PID 1848 wrote to memory of 2880 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 34 PID 2880 wrote to memory of 3500 2880 cmd.exe 36 PID 2880 wrote to memory of 3500 2880 cmd.exe 36 PID 2880 wrote to memory of 3500 2880 cmd.exe 36 PID 2880 wrote to memory of 760 2880 cmd.exe 37 PID 2880 wrote to memory of 760 2880 cmd.exe 37 PID 2880 wrote to memory of 760 2880 cmd.exe 37 PID 1848 wrote to memory of 3128 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 38 PID 1848 wrote to memory of 3128 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 38 PID 1848 wrote to memory of 3128 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 38 PID 1848 wrote to memory of 3128 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 38 PID 1848 wrote to memory of 3592 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 39 PID 1848 wrote to memory of 3592 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 39 PID 1848 wrote to memory of 3592 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 39 PID 1848 wrote to memory of 3592 1848 2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe 39 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_2d3611a415d4b904c601df5174b3957f_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:1536
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2900
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:3500
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:760
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3128
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:3592
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD55fba0315b9f187c412b362af0d83ce9c
SHA13450670f929d8fd2f2d38736aeac195ced93993b
SHA256766f326530de73bbf74cf6e53a25f93b2394dff3720f6143634fd5ec40ced5f9
SHA512d59ba99475862c4b6e9e19b61d53964367f9942a31d6f6ae6a1d065e9f7cf9510acba07e282dcb71fdcf78f8ebcc692b25ce5b853ce3e68af1aff0d9d3b29647