Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 14:06
Static task
static1
Behavioral task
behavioral1
Sample
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe
Resource
win10v20201028
General
-
Target
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe
-
Size
191KB
-
MD5
20f0c736a966142de88dee06a2e4a5b1
-
SHA1
afb2fe6b541069259b0fd9be82d62594a361afb0
-
SHA256
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3
-
SHA512
a012898e9e8cc6789cbaea7a36f54140f1b70c45b8874f2f5504ea3971494d5856f7f54aaa00dc37a3746362d85b54c665bc485f0e7d491ec99e9155950c7e43
Malware Config
Extracted
C:\readme.txt
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exedescription ioc process File renamed C:\Users\Admin\Pictures\DenyImport.raw => C:\Users\Admin\Pictures\DenyImport.raw.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Pictures\FindStep.tiff 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\FindStep.tiff => C:\Users\Admin\Pictures\FindStep.tiff.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\PushReset.crw => C:\Users\Admin\Pictures\PushReset.crw.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\RequestCompress.raw => C:\Users\Admin\Pictures\RequestCompress.raw.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\SetHide.png => C:\Users\Admin\Pictures\SetHide.png.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\SubmitConvert.tif => C:\Users\Admin\Pictures\SubmitConvert.tif.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File renamed C:\Users\Admin\Pictures\ConvertGroup.png => C:\Users\Admin\Pictures\ConvertGroup.png.KKBKR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Links\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Documents\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Videos\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Music\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\AT22T7OH\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Music\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\F6O5NPVK\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\8DDKLDOL\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RKGIF8TT\desktop.ini 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Drops file in Program Files directory 8817 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\WPGIMP32.FLT 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00513_.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR23F.GIF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBCALSO.POC 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0290548.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\STUBBY1.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\Java\jre7\lib\management\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01255G.GIF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9F.GIF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0214934.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00468_.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\PUSH.WAV 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086478.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215210.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Google\Chrome\Application\86.0.4240.111\default_apps\youtube.crx 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382925.JPG 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.XML 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.JPG 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montevideo 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01160_.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01848_.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00610_.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Adobe.css 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18249_.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\NL.ROGERS.COM.XML 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE.DPV 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\readme.txt 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Suspicious behavior: EnumeratesProcesses 157 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exepid process 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe -
Suspicious use of AdjustPrivilegeToken 443 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1636 vssvc.exe Token: SeRestorePrivilege 1636 vssvc.exe Token: SeAuditPrivilege 1636 vssvc.exe Token: SeIncreaseQuotaPrivilege 1020 WMIC.exe Token: SeSecurityPrivilege 1020 WMIC.exe Token: SeTakeOwnershipPrivilege 1020 WMIC.exe Token: SeLoadDriverPrivilege 1020 WMIC.exe Token: SeSystemProfilePrivilege 1020 WMIC.exe Token: SeSystemtimePrivilege 1020 WMIC.exe Token: SeProfSingleProcessPrivilege 1020 WMIC.exe Token: SeIncBasePriorityPrivilege 1020 WMIC.exe Token: SeCreatePagefilePrivilege 1020 WMIC.exe Token: SeBackupPrivilege 1020 WMIC.exe Token: SeRestorePrivilege 1020 WMIC.exe Token: SeShutdownPrivilege 1020 WMIC.exe Token: SeDebugPrivilege 1020 WMIC.exe Token: SeSystemEnvironmentPrivilege 1020 WMIC.exe Token: SeRemoteShutdownPrivilege 1020 WMIC.exe Token: SeUndockPrivilege 1020 WMIC.exe Token: SeManageVolumePrivilege 1020 WMIC.exe Token: 33 1020 WMIC.exe Token: 34 1020 WMIC.exe Token: 35 1020 WMIC.exe Token: SeIncreaseQuotaPrivilege 1020 WMIC.exe Token: SeSecurityPrivilege 1020 WMIC.exe Token: SeTakeOwnershipPrivilege 1020 WMIC.exe Token: SeLoadDriverPrivilege 1020 WMIC.exe Token: SeSystemProfilePrivilege 1020 WMIC.exe Token: SeSystemtimePrivilege 1020 WMIC.exe Token: SeProfSingleProcessPrivilege 1020 WMIC.exe Token: SeIncBasePriorityPrivilege 1020 WMIC.exe Token: SeCreatePagefilePrivilege 1020 WMIC.exe Token: SeBackupPrivilege 1020 WMIC.exe Token: SeRestorePrivilege 1020 WMIC.exe Token: SeShutdownPrivilege 1020 WMIC.exe Token: SeDebugPrivilege 1020 WMIC.exe Token: SeSystemEnvironmentPrivilege 1020 WMIC.exe Token: SeRemoteShutdownPrivilege 1020 WMIC.exe Token: SeUndockPrivilege 1020 WMIC.exe Token: SeManageVolumePrivilege 1020 WMIC.exe Token: 33 1020 WMIC.exe Token: 34 1020 WMIC.exe Token: 35 1020 WMIC.exe Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe Token: SeSecurityPrivilege 1504 WMIC.exe Token: SeTakeOwnershipPrivilege 1504 WMIC.exe Token: SeLoadDriverPrivilege 1504 WMIC.exe Token: SeSystemProfilePrivilege 1504 WMIC.exe Token: SeSystemtimePrivilege 1504 WMIC.exe Token: SeProfSingleProcessPrivilege 1504 WMIC.exe Token: SeIncBasePriorityPrivilege 1504 WMIC.exe Token: SeCreatePagefilePrivilege 1504 WMIC.exe Token: SeBackupPrivilege 1504 WMIC.exe Token: SeRestorePrivilege 1504 WMIC.exe Token: SeShutdownPrivilege 1504 WMIC.exe Token: SeDebugPrivilege 1504 WMIC.exe Token: SeSystemEnvironmentPrivilege 1504 WMIC.exe Token: SeRemoteShutdownPrivilege 1504 WMIC.exe Token: SeUndockPrivilege 1504 WMIC.exe Token: SeManageVolumePrivilege 1504 WMIC.exe Token: 33 1504 WMIC.exe Token: 34 1504 WMIC.exe Token: 35 1504 WMIC.exe Token: SeIncreaseQuotaPrivilege 1504 WMIC.exe -
Suspicious use of WriteProcessMemory 77 IoCs
Processes:
198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1096 wrote to memory of 1808 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1808 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1808 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1808 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1808 wrote to memory of 1020 1808 cmd.exe WMIC.exe PID 1808 wrote to memory of 1020 1808 cmd.exe WMIC.exe PID 1808 wrote to memory of 1020 1808 cmd.exe WMIC.exe PID 1096 wrote to memory of 1156 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1156 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1156 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1156 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1156 wrote to memory of 1504 1156 cmd.exe WMIC.exe PID 1156 wrote to memory of 1504 1156 cmd.exe WMIC.exe PID 1156 wrote to memory of 1504 1156 cmd.exe WMIC.exe PID 1096 wrote to memory of 764 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 764 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 764 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 764 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 764 wrote to memory of 1540 764 cmd.exe WMIC.exe PID 764 wrote to memory of 1540 764 cmd.exe WMIC.exe PID 764 wrote to memory of 1540 764 cmd.exe WMIC.exe PID 1096 wrote to memory of 660 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 660 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 660 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 660 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 660 wrote to memory of 1052 660 cmd.exe WMIC.exe PID 660 wrote to memory of 1052 660 cmd.exe WMIC.exe PID 660 wrote to memory of 1052 660 cmd.exe WMIC.exe PID 1096 wrote to memory of 1332 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1332 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1332 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1332 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1332 wrote to memory of 536 1332 cmd.exe WMIC.exe PID 1332 wrote to memory of 536 1332 cmd.exe WMIC.exe PID 1332 wrote to memory of 536 1332 cmd.exe WMIC.exe PID 1096 wrote to memory of 396 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 396 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 396 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 396 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 396 wrote to memory of 1132 396 cmd.exe WMIC.exe PID 396 wrote to memory of 1132 396 cmd.exe WMIC.exe PID 396 wrote to memory of 1132 396 cmd.exe WMIC.exe PID 1096 wrote to memory of 108 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 108 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 108 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 108 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 108 wrote to memory of 1300 108 cmd.exe WMIC.exe PID 108 wrote to memory of 1300 108 cmd.exe WMIC.exe PID 108 wrote to memory of 1300 108 cmd.exe WMIC.exe PID 1096 wrote to memory of 1940 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1940 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1940 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1940 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1940 wrote to memory of 788 1940 cmd.exe WMIC.exe PID 1940 wrote to memory of 788 1940 cmd.exe WMIC.exe PID 1940 wrote to memory of 788 1940 cmd.exe WMIC.exe PID 1096 wrote to memory of 1420 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1420 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1420 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1096 wrote to memory of 1420 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe PID 1420 wrote to memory of 1348 1420 cmd.exe WMIC.exe PID 1420 wrote to memory of 1348 1420 cmd.exe WMIC.exe PID 1420 wrote to memory of 1348 1420 cmd.exe WMIC.exe PID 1096 wrote to memory of 1332 1096 198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe"C:\Users\Admin\AppData\Local\Temp\198667b1eda010a431dfb051a101cc73ead1d45ba8d0f6641ec1c14bca4106f3.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6C94F5DE-71AA-4748-A6E4-65D732C8E17B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6C94F5DE-71AA-4748-A6E4-65D732C8E17B}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AEAC8CFA-3DBF-4075-86C2-AEB4E13B8C8D}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AEAC8CFA-3DBF-4075-86C2-AEB4E13B8C8D}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C0A63CD4-7BC9-443E-B08E-F75B9AAA7BEE}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C0A63CD4-7BC9-443E-B08E-F75B9AAA7BEE}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A8F9DEFE-0315-4860-BBD3-3EA51B04277B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A8F9DEFE-0315-4860-BBD3-3EA51B04277B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F485DFB7-940C-445F-89B0-830CD4C0C6AA}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F485DFB7-940C-445F-89B0-830CD4C0C6AA}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{62B550E8-FBB1-4E5A-8A36-2AD110607E82}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{62B550E8-FBB1-4E5A-8A36-2AD110607E82}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F5012BF2-8EBD-43FA-9BD9-AAC31516894B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F5012BF2-8EBD-43FA-9BD9-AAC31516894B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9311D394-0691-49F4-9843-4698E19D71B7}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9311D394-0691-49F4-9843-4698E19D71B7}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{114C0DA1-C29B-46BD-B65D-DC42616CE6F9}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{114C0DA1-C29B-46BD-B65D-DC42616CE6F9}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DCC28F2F-1AB0-404A-9561-EB252EC404F1}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DCC28F2F-1AB0-404A-9561-EB252EC404F1}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{07E5D5E7-4EB4-4081-AC00-CF87FFD39B2C}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{07E5D5E7-4EB4-4081-AC00-CF87FFD39B2C}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/108-15-0x0000000000000000-mapping.dmp
-
memory/396-13-0x0000000000000000-mapping.dmp
-
memory/436-24-0x0000000000000000-mapping.dmp
-
memory/524-22-0x0000000000000000-mapping.dmp
-
memory/536-12-0x0000000000000000-mapping.dmp
-
memory/660-9-0x0000000000000000-mapping.dmp
-
memory/764-7-0x0000000000000000-mapping.dmp
-
memory/788-18-0x0000000000000000-mapping.dmp
-
memory/1020-4-0x0000000000000000-mapping.dmp
-
memory/1052-10-0x0000000000000000-mapping.dmp
-
memory/1096-2-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/1132-14-0x0000000000000000-mapping.dmp
-
memory/1156-5-0x0000000000000000-mapping.dmp
-
memory/1300-16-0x0000000000000000-mapping.dmp
-
memory/1332-11-0x0000000000000000-mapping.dmp
-
memory/1332-21-0x0000000000000000-mapping.dmp
-
memory/1348-20-0x0000000000000000-mapping.dmp
-
memory/1420-19-0x0000000000000000-mapping.dmp
-
memory/1504-6-0x0000000000000000-mapping.dmp
-
memory/1540-8-0x0000000000000000-mapping.dmp
-
memory/1756-23-0x0000000000000000-mapping.dmp
-
memory/1808-3-0x0000000000000000-mapping.dmp
-
memory/1940-17-0x0000000000000000-mapping.dmp