conti | 6eeefc25fe1d24d3f46b554a31aea357a4cd04635db5c32dfddf28b5446c09d3

Analysis

max time kernel
152s
max time network
142s
platform
windows7_x64
resource
win7-en-20210920
submitted
24-09-2021 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
Size

195KB
MD5

2d819423ee1b9a5cfa10f0d6d3f7d88a
SHA1

dbec744594b5bd73ebb63258fd1d950392d435c9
SHA256

706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c
SHA512

abdc7543152a1abd6f0fe1844674428482d4ee4228a7792cd892c75f011896469feabf611dd4ba16e5f14d431e8a30f976c9a8c6ef7c96f9fd6c063b288692ad

Score

10^/10

conti ransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- hNnBLLUpXPkzmumguHVoFGptAHEPGFLY9A8KQ8fLb8w40RYCrN0bxZUyUhI9CHmn ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Drops file in Program Files directory 64 IoCs

Processes:

706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe

description	ioc	process
File opened for modification	C:\Program Files\InstallNew.contact	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\DVD Maker\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\RenameWatch.mp4	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\install.log	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Microsoft Office\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\InstallInitialize.wav	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\bod_r.TTF	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\Eurosti.TTF	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Google\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\SuspendMove.vsw	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\Google\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\Uninstall Information\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Internet Explorer\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\MSBuild\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\directshowtap.ax	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsource.ax	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\Java\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\GetDebug.png	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\JoinFormat.m3u	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\UninstallGrant.wdp	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\ExportRepair.bin	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\GrantUndo.wpl	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\audiodepthconverter.ax	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Internet Explorer\ie9props.propdesc	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\Microsoft Games\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\BackupResume.mp3	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\RestartUndo.php	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\SetFind.gif	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\ReadWait.mht	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\SaveSelect.dib	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\sonicsptransform.ax	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\Mozilla Firefox\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Microsoft.NET\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\UpdateApprove.dwfx	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Adobe\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Reference Assemblies\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Uninstall Information\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\CompressApprove.wmf	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\offset.ax	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\soniccolorconverter.ax	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\CloseFind.dwfx	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsink.ax	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\Microsoft Office\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
File created	C:\Program Files\MSBuild\readme.txt	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe

pid process

1104 706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe

pid	process
1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1720	vssvc.exe
Token: SeRestorePrivilege	1720	vssvc.exe
Token: SeAuditPrivilege	1720	vssvc.exe
Token: SeIncreaseQuotaPrivilege	768	WMIC.exe
Token: SeSecurityPrivilege	768	WMIC.exe
Token: SeTakeOwnershipPrivilege	768	WMIC.exe
Token: SeLoadDriverPrivilege	768	WMIC.exe
Token: SeSystemProfilePrivilege	768	WMIC.exe
Token: SeSystemtimePrivilege	768	WMIC.exe
Token: SeProfSingleProcessPrivilege	768	WMIC.exe
Token: SeIncBasePriorityPrivilege	768	WMIC.exe
Token: SeCreatePagefilePrivilege	768	WMIC.exe
Token: SeBackupPrivilege	768	WMIC.exe
Token: SeRestorePrivilege	768	WMIC.exe
Token: SeShutdownPrivilege	768	WMIC.exe
Token: SeDebugPrivilege	768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	768	WMIC.exe
Token: SeRemoteShutdownPrivilege	768	WMIC.exe
Token: SeUndockPrivilege	768	WMIC.exe
Token: SeManageVolumePrivilege	768	WMIC.exe
Token: 33	768	WMIC.exe
Token: 34	768	WMIC.exe
Token: 35	768	WMIC.exe
Token: SeIncreaseQuotaPrivilege	768	WMIC.exe
Token: SeSecurityPrivilege	768	WMIC.exe
Token: SeTakeOwnershipPrivilege	768	WMIC.exe
Token: SeLoadDriverPrivilege	768	WMIC.exe
Token: SeSystemProfilePrivilege	768	WMIC.exe
Token: SeSystemtimePrivilege	768	WMIC.exe
Token: SeProfSingleProcessPrivilege	768	WMIC.exe
Token: SeIncBasePriorityPrivilege	768	WMIC.exe
Token: SeCreatePagefilePrivilege	768	WMIC.exe
Token: SeBackupPrivilege	768	WMIC.exe
Token: SeRestorePrivilege	768	WMIC.exe
Token: SeShutdownPrivilege	768	WMIC.exe
Token: SeDebugPrivilege	768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	768	WMIC.exe
Token: SeRemoteShutdownPrivilege	768	WMIC.exe
Token: SeUndockPrivilege	768	WMIC.exe
Token: SeManageVolumePrivilege	768	WMIC.exe
Token: 33	768	WMIC.exe
Token: 34	768	WMIC.exe
Token: 35	768	WMIC.exe
Token: SeIncreaseQuotaPrivilege	824	WMIC.exe
Token: SeSecurityPrivilege	824	WMIC.exe
Token: SeTakeOwnershipPrivilege	824	WMIC.exe
Token: SeLoadDriverPrivilege	824	WMIC.exe
Token: SeSystemProfilePrivilege	824	WMIC.exe
Token: SeSystemtimePrivilege	824	WMIC.exe
Token: SeProfSingleProcessPrivilege	824	WMIC.exe
Token: SeIncBasePriorityPrivilege	824	WMIC.exe
Token: SeCreatePagefilePrivilege	824	WMIC.exe
Token: SeBackupPrivilege	824	WMIC.exe
Token: SeRestorePrivilege	824	WMIC.exe
Token: SeShutdownPrivilege	824	WMIC.exe
Token: SeDebugPrivilege	824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	824	WMIC.exe
Token: SeRemoteShutdownPrivilege	824	WMIC.exe
Token: SeUndockPrivilege	824	WMIC.exe
Token: SeManageVolumePrivilege	824	WMIC.exe
Token: 33	824	WMIC.exe
Token: 34	824	WMIC.exe
Token: 35	824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	824	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1104 wrote to memory of 1208	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1208	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1208	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1208	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1208 wrote to memory of 768	1208	cmd.exe	WMIC.exe
PID 1208 wrote to memory of 768	1208	cmd.exe	WMIC.exe
PID 1208 wrote to memory of 768	1208	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 1124	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1124	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1124	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1124	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1124 wrote to memory of 824	1124	cmd.exe	WMIC.exe
PID 1124 wrote to memory of 824	1124	cmd.exe	WMIC.exe
PID 1124 wrote to memory of 824	1124	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 1344	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1344	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1344	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1344	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1344 wrote to memory of 1976	1344	cmd.exe	WMIC.exe
PID 1344 wrote to memory of 1976	1344	cmd.exe	WMIC.exe
PID 1344 wrote to memory of 1976	1344	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 748	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 748	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 748	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 748	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 748 wrote to memory of 2004	748	cmd.exe	WMIC.exe
PID 748 wrote to memory of 2004	748	cmd.exe	WMIC.exe
PID 748 wrote to memory of 2004	748	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 1312	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1312	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1312	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1312	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1312 wrote to memory of 1412	1312	cmd.exe	WMIC.exe
PID 1312 wrote to memory of 1412	1312	cmd.exe	WMIC.exe
PID 1312 wrote to memory of 1412	1312	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 1900	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1900	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1900	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 1900	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1900 wrote to memory of 1760	1900	cmd.exe	WMIC.exe
PID 1900 wrote to memory of 1760	1900	cmd.exe	WMIC.exe
PID 1900 wrote to memory of 1760	1900	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 2020	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 2020	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 2020	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 2020	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 2020 wrote to memory of 1724	2020	cmd.exe	WMIC.exe
PID 2020 wrote to memory of 1724	2020	cmd.exe	WMIC.exe
PID 2020 wrote to memory of 1724	2020	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 664	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 664	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 664	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 664	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 664 wrote to memory of 1508	664	cmd.exe	WMIC.exe
PID 664 wrote to memory of 1508	664	cmd.exe	WMIC.exe
PID 664 wrote to memory of 1508	664	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 580	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 580	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 580	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 1104 wrote to memory of 580	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe
PID 580 wrote to memory of 1112	580	cmd.exe	WMIC.exe
PID 580 wrote to memory of 1112	580	cmd.exe	WMIC.exe
PID 580 wrote to memory of 1112	580	cmd.exe	WMIC.exe
PID 1104 wrote to memory of 1500	1104	706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
"C:\Users\Admin\AppData\Local\Temp\706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
3⤵
PID:1976

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
3⤵
PID:2004

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
3⤵
PID:1412

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
3⤵
PID:1760

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
3⤵
PID:1724

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:664

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
3⤵
PID:1508

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:580

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
3⤵
PID:1112

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
2⤵
PID:1500

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
3⤵
PID:1788

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
2⤵
PID:1816

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
3⤵
PID:1880

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
2⤵
PID:1496

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
3⤵
PID:1300

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-71-0x0000000000000000-mapping.dmp

Download
memory/664-69-0x0000000000000000-mapping.dmp

Download
memory/748-61-0x0000000000000000-mapping.dmp

Download
memory/768-56-0x0000000000000000-mapping.dmp

Download
memory/824-58-0x0000000000000000-mapping.dmp

Download
memory/1104-54-0x0000000074F81000-0x0000000074F83000-memory.dmp

Filesize
8KB

Download
memory/1112-72-0x0000000000000000-mapping.dmp

Download
memory/1124-57-0x0000000000000000-mapping.dmp

Download
memory/1208-55-0x0000000000000000-mapping.dmp

Download
memory/1300-78-0x0000000000000000-mapping.dmp

Download
memory/1312-63-0x0000000000000000-mapping.dmp

Download
memory/1344-59-0x0000000000000000-mapping.dmp

Download
memory/1412-64-0x0000000000000000-mapping.dmp

Download
memory/1496-77-0x0000000000000000-mapping.dmp

Download
memory/1500-73-0x0000000000000000-mapping.dmp

Download
memory/1508-70-0x0000000000000000-mapping.dmp

Download
memory/1724-68-0x0000000000000000-mapping.dmp

Download
memory/1760-66-0x0000000000000000-mapping.dmp

Download
memory/1788-74-0x0000000000000000-mapping.dmp

Download
memory/1816-75-0x0000000000000000-mapping.dmp

Download
memory/1880-76-0x0000000000000000-mapping.dmp

Download
memory/1900-65-0x0000000000000000-mapping.dmp

Download
memory/1976-60-0x0000000000000000-mapping.dmp

Download
memory/2004-62-0x0000000000000000-mapping.dmp

Download
memory/2020-67-0x0000000000000000-mapping.dmp

Download