Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 19:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe
-
Size
92KB
-
MD5
aeeca263a2eb91ebd73b6eb26f8e7cdd
-
SHA1
bf2a85ad6f33912c1303ce8e42f49279928ff24e
-
SHA256
053ad1992cea90c611c41a184ed9302ad503cf94e2092f33e8fae9fbbb2ebe76
-
SHA512
335bc1953ccbc46d4f18e8ec70e7ec8e7633e3826c614714cf04cec01a8387a8b976d202e76c0daec475a357bef453779dbca6de8abc5f9d33081d2bd66132d7
-
SSDEEP
1536:GBwl+KXpsqN5vlwWYyhZ9S4AwVsOF7+9UFEkzgAhRJpOKGkEb1S/:ww+asqN5aW/hSS1iUFEkJLJcUEb1S/
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
Signatures
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 5 IoCs
Processes:
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe = "C:\\Windows\\System32\\2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe" 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\"" 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\"" 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\1D5U9W0O\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Y8NTX1F\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SKAMU6WE\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Z74IJYR\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9PLWLLW7\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\03PVXV8P\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe -
Drops file in System32 directory 2 IoCs
Processes:
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exedescription ioc process File created C:\Windows\System32\Info.hta 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Windows\System32\2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239057.WMF 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMaskSmall.bmp.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00242_.WMF 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Port-au-Prince.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14595_.GIF 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME34.CSS 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\skins\skin.catalog.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00445_.WMF 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\Java\jre7\lib\zi\America\Menominee.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_de.dll.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.rll 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libball_plugin.dll.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49F.GIF 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UCT 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Windows Media Player\es-ES\mpvis.dll.mui 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialLetter.dotx.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107328.WMF 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\OliveGreen.css.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\System.AddIn.dll.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21304_.GIF 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RESENDL.ICO.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\MoreGames.dll.mui.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.DesignTime.tlb 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSWAVY.WMF.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ.DLL.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18235_.WMF.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGNS.ICO.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.id-F56E7437.[[email protected]].get 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2064 vssadmin.exe 1768 vssadmin.exe -
Processes:
mshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exepid process 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1544 vssvc.exe Token: SeRestorePrivilege 1544 vssvc.exe Token: SeAuditPrivilege 1544 vssvc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.execmd.execmd.exedescription pid process target process PID 3000 wrote to memory of 1808 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 3000 wrote to memory of 1808 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 3000 wrote to memory of 1808 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 3000 wrote to memory of 1808 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 1808 wrote to memory of 2840 1808 cmd.exe mode.com PID 1808 wrote to memory of 2840 1808 cmd.exe mode.com PID 1808 wrote to memory of 2840 1808 cmd.exe mode.com PID 1808 wrote to memory of 2064 1808 cmd.exe vssadmin.exe PID 1808 wrote to memory of 2064 1808 cmd.exe vssadmin.exe PID 1808 wrote to memory of 2064 1808 cmd.exe vssadmin.exe PID 3000 wrote to memory of 2316 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 3000 wrote to memory of 2316 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 3000 wrote to memory of 2316 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 3000 wrote to memory of 2316 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe cmd.exe PID 2316 wrote to memory of 2560 2316 cmd.exe mode.com PID 2316 wrote to memory of 2560 2316 cmd.exe mode.com PID 2316 wrote to memory of 2560 2316 cmd.exe mode.com PID 2316 wrote to memory of 1768 2316 cmd.exe vssadmin.exe PID 2316 wrote to memory of 1768 2316 cmd.exe vssadmin.exe PID 2316 wrote to memory of 1768 2316 cmd.exe vssadmin.exe PID 3000 wrote to memory of 596 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe PID 3000 wrote to memory of 596 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe PID 3000 wrote to memory of 596 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe PID 3000 wrote to memory of 596 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe PID 3000 wrote to memory of 2396 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe PID 3000 wrote to memory of 2396 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe PID 3000 wrote to memory of 2396 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe PID 3000 wrote to memory of 2396 3000 2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe mshta.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-14_aeeca263a2eb91ebd73b6eb26f8e7cdd_crysis_dharma.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2840
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2064 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\mode.commode con cp select=12513⤵PID:2560
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1768 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:596 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"2⤵
- Modifies Internet Explorer settings
PID:2396
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.id-F56E7437.[[email protected]].get
Filesize23.5MB
MD5004f325b45aacce102f6b71dc6481998
SHA1714a3200e3f07d0ef78e0a3c5e80b2008bbaef14
SHA256c2aa671c4991426e4bd281b43bb2b24cdec37385d5b84285168963dfa0423810
SHA512206189f779a0814d286e922f7e0965b4eb96788b95dc2f278d02ad866bb14c5540f9f070b4b4ce4ea8c29ace7ceb4618cd6de7f642218e02c366c5024e2be632
-
Filesize
7KB
MD5cc49b3ae5a192402e912e92b676093a2
SHA158ab496ad3ee398c1b2a9c925aa2c42cfd453685
SHA2564cab25ac222e655aad5c5ce1b8ca51a945435af243e39a6aebc3fe0b083b3a5a
SHA5123b522db80e112b285f78f113db6d541d48ca2169bd22a49a07a321cb64cb18220412b6deb13a33300cdf3ff2d2a59fe4bea623a4b9ef05c5bd3286bfad703b26