Overview
overview
10Static
static
81814a6a674...67.exe
windows7_x64
31814a6a674...67.exe
windows10_x64
102ca4f97e15...51.exe
windows7_x64
102ca4f97e15...51.exe
windows10_x64
103db6e8df73...3b.dll
windows7_x64
103db6e8df73...3b.dll
windows10_x64
103e2ce6fd7b...a5.exe
windows7_x64
103e2ce6fd7b...a5.exe
windows10_x64
10463b34821a...40.exe
windows7_x64
10463b34821a...40.exe
windows10_x64
34f4a33f700...72.exe
windows7_x64
104f4a33f700...72.exe
windows10_x64
853b1c1b2f4...22.exe
windows7_x64
1053b1c1b2f4...22.exe
windows10_x64
1062b2822215...d3.exe
windows7_x64
962b2822215...d3.exe
windows10_x64
96bc6f60b87...bc.dll
windows7_x64
106bc6f60b87...bc.dll
windows10_x64
106f7043b24d...1d.dll
windows7_x64
16f7043b24d...1d.dll
windows10_x64
3706a8a4fc4...1c.exe
windows7_x64
10706a8a4fc4...1c.exe
windows10_x64
107236c8098c...8e.exe
windows7_x64
107236c8098c...8e.exe
windows10_x64
1074ebfcd116...dd.dll
windows7_x64
1074ebfcd116...dd.dll
windows10_x64
107fbeac1dca...de.exe
windows7_x64
107fbeac1dca...de.exe
windows10_x64
1087e6f7b20e...89.exe
windows7_x64
387e6f7b20e...89.exe
windows10_x64
3918127c59e...3d.exe
windows7_x64
10918127c59e...3d.exe
windows10_x64
10Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-09-2021 10:27
Behavioral task
behavioral1
Sample
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral2
Sample
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral3
Sample
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral4
Sample
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral5
Sample
3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral6
Sample
3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral7
Sample
3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral8
Sample
3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral9
Sample
463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral10
Sample
463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral11
Sample
4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral12
Sample
4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral13
Sample
53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral14
Sample
53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral15
Sample
62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral16
Sample
62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral17
Sample
6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral18
Sample
6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral19
Sample
6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral20
Sample
6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral21
Sample
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral22
Sample
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral23
Sample
7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral24
Sample
7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral25
Sample
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral26
Sample
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral27
Sample
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral28
Sample
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral29
Sample
87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral30
Sample
87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral31
Sample
918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral32
Sample
918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe
Resource
win10v20210408
windows10_x64
General
-
Target
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
-
Size
195KB
-
MD5
2d819423ee1b9a5cfa10f0d6d3f7d88a
-
SHA1
dbec744594b5bd73ebb63258fd1d950392d435c9
-
SHA256
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c
-
SHA512
abdc7543152a1abd6f0fe1844674428482d4ee4228a7792cd892c75f011896469feabf611dd4ba16e5f14d431e8a30f976c9a8c6ef7c96f9fd6c063b288692ad
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\InstallNew.contact 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\DVD Maker\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\RenameWatch.mp4 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\InstallInitialize.wav 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Google\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\SuspendMove.vsw 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\7-Zip\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\7-Zip\License.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\Google\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\Uninstall Information\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\MSBuild\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\directshowtap.ax 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\Java\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\GetDebug.png 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\JoinFormat.m3u 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\UninstallGrant.wdp 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\ExportRepair.bin 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\GrantUndo.wpl 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\Microsoft Games\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\BackupResume.mp3 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\RestartUndo.php 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\SetFind.gif 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\ReadWait.mht 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\SaveSelect.dib 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\Mozilla Firefox\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\UpdateApprove.dwfx 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Adobe\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\CompressApprove.wmf 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\CloseFind.dwfx 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\7-Zip\History.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\Microsoft Office\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe File created C:\Program Files\MSBuild\readme.txt 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 1720 vssvc.exe Token: SeRestorePrivilege 1720 vssvc.exe Token: SeAuditPrivilege 1720 vssvc.exe Token: SeIncreaseQuotaPrivilege 768 WMIC.exe Token: SeSecurityPrivilege 768 WMIC.exe Token: SeTakeOwnershipPrivilege 768 WMIC.exe Token: SeLoadDriverPrivilege 768 WMIC.exe Token: SeSystemProfilePrivilege 768 WMIC.exe Token: SeSystemtimePrivilege 768 WMIC.exe Token: SeProfSingleProcessPrivilege 768 WMIC.exe Token: SeIncBasePriorityPrivilege 768 WMIC.exe Token: SeCreatePagefilePrivilege 768 WMIC.exe Token: SeBackupPrivilege 768 WMIC.exe Token: SeRestorePrivilege 768 WMIC.exe Token: SeShutdownPrivilege 768 WMIC.exe Token: SeDebugPrivilege 768 WMIC.exe Token: SeSystemEnvironmentPrivilege 768 WMIC.exe Token: SeRemoteShutdownPrivilege 768 WMIC.exe Token: SeUndockPrivilege 768 WMIC.exe Token: SeManageVolumePrivilege 768 WMIC.exe Token: 33 768 WMIC.exe Token: 34 768 WMIC.exe Token: 35 768 WMIC.exe Token: SeIncreaseQuotaPrivilege 768 WMIC.exe Token: SeSecurityPrivilege 768 WMIC.exe Token: SeTakeOwnershipPrivilege 768 WMIC.exe Token: SeLoadDriverPrivilege 768 WMIC.exe Token: SeSystemProfilePrivilege 768 WMIC.exe Token: SeSystemtimePrivilege 768 WMIC.exe Token: SeProfSingleProcessPrivilege 768 WMIC.exe Token: SeIncBasePriorityPrivilege 768 WMIC.exe Token: SeCreatePagefilePrivilege 768 WMIC.exe Token: SeBackupPrivilege 768 WMIC.exe Token: SeRestorePrivilege 768 WMIC.exe Token: SeShutdownPrivilege 768 WMIC.exe Token: SeDebugPrivilege 768 WMIC.exe Token: SeSystemEnvironmentPrivilege 768 WMIC.exe Token: SeRemoteShutdownPrivilege 768 WMIC.exe Token: SeUndockPrivilege 768 WMIC.exe Token: SeManageVolumePrivilege 768 WMIC.exe Token: 33 768 WMIC.exe Token: 34 768 WMIC.exe Token: 35 768 WMIC.exe Token: SeIncreaseQuotaPrivilege 824 WMIC.exe Token: SeSecurityPrivilege 824 WMIC.exe Token: SeTakeOwnershipPrivilege 824 WMIC.exe Token: SeLoadDriverPrivilege 824 WMIC.exe Token: SeSystemProfilePrivilege 824 WMIC.exe Token: SeSystemtimePrivilege 824 WMIC.exe Token: SeProfSingleProcessPrivilege 824 WMIC.exe Token: SeIncBasePriorityPrivilege 824 WMIC.exe Token: SeCreatePagefilePrivilege 824 WMIC.exe Token: SeBackupPrivilege 824 WMIC.exe Token: SeRestorePrivilege 824 WMIC.exe Token: SeShutdownPrivilege 824 WMIC.exe Token: SeDebugPrivilege 824 WMIC.exe Token: SeSystemEnvironmentPrivilege 824 WMIC.exe Token: SeRemoteShutdownPrivilege 824 WMIC.exe Token: SeUndockPrivilege 824 WMIC.exe Token: SeManageVolumePrivilege 824 WMIC.exe Token: 33 824 WMIC.exe Token: 34 824 WMIC.exe Token: 35 824 WMIC.exe Token: SeIncreaseQuotaPrivilege 824 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1208 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 30 PID 1104 wrote to memory of 1208 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 30 PID 1104 wrote to memory of 1208 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 30 PID 1104 wrote to memory of 1208 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 30 PID 1208 wrote to memory of 768 1208 cmd.exe 32 PID 1208 wrote to memory of 768 1208 cmd.exe 32 PID 1208 wrote to memory of 768 1208 cmd.exe 32 PID 1104 wrote to memory of 1124 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 33 PID 1104 wrote to memory of 1124 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 33 PID 1104 wrote to memory of 1124 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 33 PID 1104 wrote to memory of 1124 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 33 PID 1124 wrote to memory of 824 1124 cmd.exe 35 PID 1124 wrote to memory of 824 1124 cmd.exe 35 PID 1124 wrote to memory of 824 1124 cmd.exe 35 PID 1104 wrote to memory of 1344 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 36 PID 1104 wrote to memory of 1344 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 36 PID 1104 wrote to memory of 1344 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 36 PID 1104 wrote to memory of 1344 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 36 PID 1344 wrote to memory of 1976 1344 cmd.exe 38 PID 1344 wrote to memory of 1976 1344 cmd.exe 38 PID 1344 wrote to memory of 1976 1344 cmd.exe 38 PID 1104 wrote to memory of 748 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 39 PID 1104 wrote to memory of 748 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 39 PID 1104 wrote to memory of 748 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 39 PID 1104 wrote to memory of 748 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 39 PID 748 wrote to memory of 2004 748 cmd.exe 41 PID 748 wrote to memory of 2004 748 cmd.exe 41 PID 748 wrote to memory of 2004 748 cmd.exe 41 PID 1104 wrote to memory of 1312 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 42 PID 1104 wrote to memory of 1312 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 42 PID 1104 wrote to memory of 1312 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 42 PID 1104 wrote to memory of 1312 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 42 PID 1312 wrote to memory of 1412 1312 cmd.exe 44 PID 1312 wrote to memory of 1412 1312 cmd.exe 44 PID 1312 wrote to memory of 1412 1312 cmd.exe 44 PID 1104 wrote to memory of 1900 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 45 PID 1104 wrote to memory of 1900 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 45 PID 1104 wrote to memory of 1900 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 45 PID 1104 wrote to memory of 1900 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 45 PID 1900 wrote to memory of 1760 1900 cmd.exe 47 PID 1900 wrote to memory of 1760 1900 cmd.exe 47 PID 1900 wrote to memory of 1760 1900 cmd.exe 47 PID 1104 wrote to memory of 2020 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 48 PID 1104 wrote to memory of 2020 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 48 PID 1104 wrote to memory of 2020 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 48 PID 1104 wrote to memory of 2020 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 48 PID 2020 wrote to memory of 1724 2020 cmd.exe 50 PID 2020 wrote to memory of 1724 2020 cmd.exe 50 PID 2020 wrote to memory of 1724 2020 cmd.exe 50 PID 1104 wrote to memory of 664 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 51 PID 1104 wrote to memory of 664 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 51 PID 1104 wrote to memory of 664 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 51 PID 1104 wrote to memory of 664 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 51 PID 664 wrote to memory of 1508 664 cmd.exe 53 PID 664 wrote to memory of 1508 664 cmd.exe 53 PID 664 wrote to memory of 1508 664 cmd.exe 53 PID 1104 wrote to memory of 580 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 54 PID 1104 wrote to memory of 580 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 54 PID 1104 wrote to memory of 580 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 54 PID 1104 wrote to memory of 580 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 54 PID 580 wrote to memory of 1112 580 cmd.exe 56 PID 580 wrote to memory of 1112 580 cmd.exe 56 PID 580 wrote to memory of 1112 580 cmd.exe 56 PID 1104 wrote to memory of 1500 1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe"C:\Users\Admin\AppData\Local\Temp\706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵PID:1976
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵PID:2004
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵PID:1412
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵PID:1760
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵PID:1724
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵PID:1508
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵PID:1112
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵PID:1500
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵PID:1788
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵PID:1816
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵PID:1880
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵PID:1496
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵PID:1300
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720