Overview
overview
10Static
static
81814a6a674...67.exe
windows7_x64
31814a6a674...67.exe
windows10_x64
102ca4f97e15...51.exe
windows7_x64
102ca4f97e15...51.exe
windows10_x64
103db6e8df73...3b.dll
windows7_x64
103db6e8df73...3b.dll
windows10_x64
103e2ce6fd7b...a5.exe
windows7_x64
103e2ce6fd7b...a5.exe
windows10_x64
10463b34821a...40.exe
windows7_x64
10463b34821a...40.exe
windows10_x64
34f4a33f700...72.exe
windows7_x64
104f4a33f700...72.exe
windows10_x64
853b1c1b2f4...22.exe
windows7_x64
1053b1c1b2f4...22.exe
windows10_x64
1062b2822215...d3.exe
windows7_x64
962b2822215...d3.exe
windows10_x64
96bc6f60b87...bc.dll
windows7_x64
106bc6f60b87...bc.dll
windows10_x64
106f7043b24d...1d.dll
windows7_x64
16f7043b24d...1d.dll
windows10_x64
3706a8a4fc4...1c.exe
windows7_x64
10706a8a4fc4...1c.exe
windows10_x64
107236c8098c...8e.exe
windows7_x64
107236c8098c...8e.exe
windows10_x64
1074ebfcd116...dd.dll
windows7_x64
1074ebfcd116...dd.dll
windows10_x64
107fbeac1dca...de.exe
windows7_x64
107fbeac1dca...de.exe
windows10_x64
1087e6f7b20e...89.exe
windows7_x64
387e6f7b20e...89.exe
windows10_x64
3918127c59e...3d.exe
windows7_x64
10918127c59e...3d.exe
windows10_x64
10Analysis
-
max time kernel
162s -
max time network
58s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 10:27
Behavioral task
behavioral1
Sample
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral2
Sample
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral3
Sample
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral4
Sample
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral5
Sample
3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral6
Sample
3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral7
Sample
3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral8
Sample
3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral9
Sample
463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral10
Sample
463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral11
Sample
4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral12
Sample
4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral13
Sample
53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral14
Sample
53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral15
Sample
62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral16
Sample
62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral17
Sample
6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral18
Sample
6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral19
Sample
6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral20
Sample
6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral21
Sample
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral22
Sample
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral23
Sample
7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral24
Sample
7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral25
Sample
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral26
Sample
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral27
Sample
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral28
Sample
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral29
Sample
87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral30
Sample
87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral31
Sample
918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral32
Sample
918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe
Resource
win10v20210408
windows10_x64
General
-
Target
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
-
Size
195KB
-
MD5
efc8f8172303ff78d207b2eb8c78511e
-
SHA1
bdf1d7e889905e4df8485fc7dfbb9bdfb91e676e
-
SHA256
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de
-
SHA512
056d2289776db4f7ede6076d5e932e9641f3885f6096c022a7d1d06662881d7bb464d3a0605c5b40e50175541d5b370f814a4c2900b9172156161b43a8bb7d67
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\descript.ion 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\Common Files\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\EnterTest.potm 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\TraceSuspend.xsl 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\FindFormat.asp 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\SwitchStep.mht 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\UnlockUpdate.7z 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\7-Zip\History.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\VideoLAN\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\PingUnblock.dwg 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\PopRemove.pdf 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\RedoUnblock.pps 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\SelectOptimize.emz 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\DVD Maker\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Adobe\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\MergeEnable.3gpp 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DenyImport.csv 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\ProtectFind.mid 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\SkipMerge.odp 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Microsoft Sync Framework\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DebugResume.snd 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\Internet Explorer\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\MSBuild\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\7-Zip\License.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\UnregisterOptimize.ogg 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\RestoreUnprotect.bmp 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\EditUnregister.cab 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\Google\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\Java\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\MSBuild\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\RevokeImport.mpp 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\OpenConvertTo.odp 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\Uninstall Information\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Common Files\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files (x86)\Google\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File created C:\Program Files\readme.txt 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\RedoRepair.vbs 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 1840 vssvc.exe Token: SeRestorePrivilege 1840 vssvc.exe Token: SeAuditPrivilege 1840 vssvc.exe Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe Token: SeSecurityPrivilege 1992 WMIC.exe Token: SeTakeOwnershipPrivilege 1992 WMIC.exe Token: SeLoadDriverPrivilege 1992 WMIC.exe Token: SeSystemProfilePrivilege 1992 WMIC.exe Token: SeSystemtimePrivilege 1992 WMIC.exe Token: SeProfSingleProcessPrivilege 1992 WMIC.exe Token: SeIncBasePriorityPrivilege 1992 WMIC.exe Token: SeCreatePagefilePrivilege 1992 WMIC.exe Token: SeBackupPrivilege 1992 WMIC.exe Token: SeRestorePrivilege 1992 WMIC.exe Token: SeShutdownPrivilege 1992 WMIC.exe Token: SeDebugPrivilege 1992 WMIC.exe Token: SeSystemEnvironmentPrivilege 1992 WMIC.exe Token: SeRemoteShutdownPrivilege 1992 WMIC.exe Token: SeUndockPrivilege 1992 WMIC.exe Token: SeManageVolumePrivilege 1992 WMIC.exe Token: 33 1992 WMIC.exe Token: 34 1992 WMIC.exe Token: 35 1992 WMIC.exe Token: SeIncreaseQuotaPrivilege 1992 WMIC.exe Token: SeSecurityPrivilege 1992 WMIC.exe Token: SeTakeOwnershipPrivilege 1992 WMIC.exe Token: SeLoadDriverPrivilege 1992 WMIC.exe Token: SeSystemProfilePrivilege 1992 WMIC.exe Token: SeSystemtimePrivilege 1992 WMIC.exe Token: SeProfSingleProcessPrivilege 1992 WMIC.exe Token: SeIncBasePriorityPrivilege 1992 WMIC.exe Token: SeCreatePagefilePrivilege 1992 WMIC.exe Token: SeBackupPrivilege 1992 WMIC.exe Token: SeRestorePrivilege 1992 WMIC.exe Token: SeShutdownPrivilege 1992 WMIC.exe Token: SeDebugPrivilege 1992 WMIC.exe Token: SeSystemEnvironmentPrivilege 1992 WMIC.exe Token: SeRemoteShutdownPrivilege 1992 WMIC.exe Token: SeUndockPrivilege 1992 WMIC.exe Token: SeManageVolumePrivilege 1992 WMIC.exe Token: 33 1992 WMIC.exe Token: 34 1992 WMIC.exe Token: 35 1992 WMIC.exe Token: SeIncreaseQuotaPrivilege 1888 WMIC.exe Token: SeSecurityPrivilege 1888 WMIC.exe Token: SeTakeOwnershipPrivilege 1888 WMIC.exe Token: SeLoadDriverPrivilege 1888 WMIC.exe Token: SeSystemProfilePrivilege 1888 WMIC.exe Token: SeSystemtimePrivilege 1888 WMIC.exe Token: SeProfSingleProcessPrivilege 1888 WMIC.exe Token: SeIncBasePriorityPrivilege 1888 WMIC.exe Token: SeCreatePagefilePrivilege 1888 WMIC.exe Token: SeBackupPrivilege 1888 WMIC.exe Token: SeRestorePrivilege 1888 WMIC.exe Token: SeShutdownPrivilege 1888 WMIC.exe Token: SeDebugPrivilege 1888 WMIC.exe Token: SeSystemEnvironmentPrivilege 1888 WMIC.exe Token: SeRemoteShutdownPrivilege 1888 WMIC.exe Token: SeUndockPrivilege 1888 WMIC.exe Token: SeManageVolumePrivilege 1888 WMIC.exe Token: 33 1888 WMIC.exe Token: 34 1888 WMIC.exe Token: 35 1888 WMIC.exe Token: SeIncreaseQuotaPrivilege 1888 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 28 PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 28 PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 28 PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 28 PID 1048 wrote to memory of 1992 1048 cmd.exe 30 PID 1048 wrote to memory of 1992 1048 cmd.exe 30 PID 1048 wrote to memory of 1992 1048 cmd.exe 30 PID 1304 wrote to memory of 1764 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 31 PID 1304 wrote to memory of 1764 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 31 PID 1304 wrote to memory of 1764 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 31 PID 1304 wrote to memory of 1764 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 31 PID 1764 wrote to memory of 1888 1764 cmd.exe 33 PID 1764 wrote to memory of 1888 1764 cmd.exe 33 PID 1764 wrote to memory of 1888 1764 cmd.exe 33 PID 1304 wrote to memory of 1320 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 34 PID 1304 wrote to memory of 1320 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 34 PID 1304 wrote to memory of 1320 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 34 PID 1304 wrote to memory of 1320 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 34 PID 1320 wrote to memory of 1288 1320 cmd.exe 36 PID 1320 wrote to memory of 1288 1320 cmd.exe 36 PID 1320 wrote to memory of 1288 1320 cmd.exe 36 PID 1304 wrote to memory of 1440 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 37 PID 1304 wrote to memory of 1440 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 37 PID 1304 wrote to memory of 1440 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 37 PID 1304 wrote to memory of 1440 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 37 PID 1440 wrote to memory of 1600 1440 cmd.exe 39 PID 1440 wrote to memory of 1600 1440 cmd.exe 39 PID 1440 wrote to memory of 1600 1440 cmd.exe 39 PID 1304 wrote to memory of 560 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 40 PID 1304 wrote to memory of 560 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 40 PID 1304 wrote to memory of 560 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 40 PID 1304 wrote to memory of 560 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 40 PID 560 wrote to memory of 1712 560 cmd.exe 42 PID 560 wrote to memory of 1712 560 cmd.exe 42 PID 560 wrote to memory of 1712 560 cmd.exe 42 PID 1304 wrote to memory of 572 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 43 PID 1304 wrote to memory of 572 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 43 PID 1304 wrote to memory of 572 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 43 PID 1304 wrote to memory of 572 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 43 PID 572 wrote to memory of 784 572 cmd.exe 45 PID 572 wrote to memory of 784 572 cmd.exe 45 PID 572 wrote to memory of 784 572 cmd.exe 45 PID 1304 wrote to memory of 1624 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 46 PID 1304 wrote to memory of 1624 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 46 PID 1304 wrote to memory of 1624 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 46 PID 1304 wrote to memory of 1624 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 46 PID 1624 wrote to memory of 1596 1624 cmd.exe 48 PID 1624 wrote to memory of 1596 1624 cmd.exe 48 PID 1624 wrote to memory of 1596 1624 cmd.exe 48 PID 1304 wrote to memory of 1376 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 49 PID 1304 wrote to memory of 1376 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 49 PID 1304 wrote to memory of 1376 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 49 PID 1304 wrote to memory of 1376 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 49 PID 1376 wrote to memory of 1796 1376 cmd.exe 51 PID 1376 wrote to memory of 1796 1376 cmd.exe 51 PID 1376 wrote to memory of 1796 1376 cmd.exe 51 PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 52 PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 52 PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 52 PID 1304 wrote to memory of 1048 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 52 PID 1048 wrote to memory of 1404 1048 cmd.exe 54 PID 1048 wrote to memory of 1404 1048 cmd.exe 54 PID 1048 wrote to memory of 1404 1048 cmd.exe 54 PID 1304 wrote to memory of 1800 1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe"C:\Users\Admin\AppData\Local\Temp\7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete3⤵PID:1288
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete3⤵PID:1600
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete3⤵PID:1712
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete3⤵PID:784
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete3⤵PID:1596
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete3⤵PID:1796
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete3⤵PID:1404
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete2⤵PID:1800
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete3⤵PID:1540
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete2⤵PID:1240
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete3⤵PID:468
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840