conti | 6eeefc25fe1d24d3f46b554a31aea357a4cd04635db5c32dfddf28b5446c09d3

Analysis

max time kernel
162s
max time network
58s
platform
windows7_x64
resource
win7v20210408
submitted
24-09-2021 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
Size

195KB
MD5

efc8f8172303ff78d207b2eb8c78511e
SHA1

bdf1d7e889905e4df8485fc7dfbb9bdfb91e676e
SHA256

7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de
SHA512

056d2289776db4f7ede6076d5e932e9641f3885f6096c022a7d1d06662881d7bb464d3a0605c5b40e50175541d5b370f814a4c2900b9172156161b43a8bb7d67

Score

10^/10

conti ransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- ZNBmQgFGbXCmtCB0aaZmMTpHL2YtecUgu6blxIMU12WwvHaAt0PdnKmkdK1zz4PQ ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Drops file in Program Files directory 64 IoCs

Processes:

7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\descript.ion	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\Common Files\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DVD Maker\offset.ax	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\Internet Explorer\ie9props.propdesc	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Internet Explorer\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\EnterTest.potm	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\TraceSuspend.xsl	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ie9props.propdesc	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\FindFormat.asp	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\SwitchStep.mht	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\UnlockUpdate.7z	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\VideoLAN\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Microsoft Office\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\PingUnblock.dwg	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\PopRemove.pdf	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\RedoUnblock.pps	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\SelectOptimize.emz	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\DVD Maker\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Adobe\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\MergeEnable.3gpp	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DenyImport.csv	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\ProtectFind.mid	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\SkipMerge.odp	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\Mozilla Firefox\install.log	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DebugResume.snd	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DVD Maker\sonicsptransform.ax	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\Internet Explorer\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\MSBuild\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Reference Assemblies\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Uninstall Information\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\UnregisterOptimize.ogg	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\RestoreUnprotect.bmp	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DVD Maker\bod_r.TTF	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DVD Maker\Eurosti.TTF	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Microsoft.NET\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\EditUnregister.cab	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DVD Maker\soniccolorconverter.ax	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\Google\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\Java\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\MSBuild\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\RevokeImport.mpp	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\OpenConvertTo.odp	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\Uninstall Information\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Common Files\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files (x86)\Google\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File created	C:\Program Files\readme.txt	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\RedoRepair.vbs	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsink.ax	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe

pid process

1304 7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe

pid	process
1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1840	vssvc.exe
Token: SeRestorePrivilege	1840	vssvc.exe
Token: SeAuditPrivilege	1840	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1888	WMIC.exe
Token: SeSecurityPrivilege	1888	WMIC.exe
Token: SeTakeOwnershipPrivilege	1888	WMIC.exe
Token: SeLoadDriverPrivilege	1888	WMIC.exe
Token: SeSystemProfilePrivilege	1888	WMIC.exe
Token: SeSystemtimePrivilege	1888	WMIC.exe
Token: SeProfSingleProcessPrivilege	1888	WMIC.exe
Token: SeIncBasePriorityPrivilege	1888	WMIC.exe
Token: SeCreatePagefilePrivilege	1888	WMIC.exe
Token: SeBackupPrivilege	1888	WMIC.exe
Token: SeRestorePrivilege	1888	WMIC.exe
Token: SeShutdownPrivilege	1888	WMIC.exe
Token: SeDebugPrivilege	1888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1888	WMIC.exe
Token: SeRemoteShutdownPrivilege	1888	WMIC.exe
Token: SeUndockPrivilege	1888	WMIC.exe
Token: SeManageVolumePrivilege	1888	WMIC.exe
Token: 33	1888	WMIC.exe
Token: 34	1888	WMIC.exe
Token: 35	1888	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1888	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1048 wrote to memory of 1992	1048	cmd.exe	WMIC.exe
PID 1048 wrote to memory of 1992	1048	cmd.exe	WMIC.exe
PID 1048 wrote to memory of 1992	1048	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 1764	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1764	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1764	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1764	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1764 wrote to memory of 1888	1764	cmd.exe	WMIC.exe
PID 1764 wrote to memory of 1888	1764	cmd.exe	WMIC.exe
PID 1764 wrote to memory of 1888	1764	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 1320	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1320	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1320	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1320	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1320 wrote to memory of 1288	1320	cmd.exe	WMIC.exe
PID 1320 wrote to memory of 1288	1320	cmd.exe	WMIC.exe
PID 1320 wrote to memory of 1288	1320	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 1440	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1440	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1440	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1440	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1440 wrote to memory of 1600	1440	cmd.exe	WMIC.exe
PID 1440 wrote to memory of 1600	1440	cmd.exe	WMIC.exe
PID 1440 wrote to memory of 1600	1440	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 560	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 560	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 560	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 560	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 560 wrote to memory of 1712	560	cmd.exe	WMIC.exe
PID 560 wrote to memory of 1712	560	cmd.exe	WMIC.exe
PID 560 wrote to memory of 1712	560	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 572	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 572	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 572	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 572	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 572 wrote to memory of 784	572	cmd.exe	WMIC.exe
PID 572 wrote to memory of 784	572	cmd.exe	WMIC.exe
PID 572 wrote to memory of 784	572	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 1624	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1624	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1624	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1624	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1624 wrote to memory of 1596	1624	cmd.exe	WMIC.exe
PID 1624 wrote to memory of 1596	1624	cmd.exe	WMIC.exe
PID 1624 wrote to memory of 1596	1624	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 1376	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1376	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1376	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1376	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1376 wrote to memory of 1796	1376	cmd.exe	WMIC.exe
PID 1376 wrote to memory of 1796	1376	cmd.exe	WMIC.exe
PID 1376 wrote to memory of 1796	1376	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1304 wrote to memory of 1048	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe
PID 1048 wrote to memory of 1404	1048	cmd.exe	WMIC.exe
PID 1048 wrote to memory of 1404	1048	cmd.exe	WMIC.exe
PID 1048 wrote to memory of 1404	1048	cmd.exe	WMIC.exe
PID 1304 wrote to memory of 1800	1304	7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
"C:\Users\Admin\AppData\Local\Temp\7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete
3⤵
PID:1288

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete
3⤵
PID:1600

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete
3⤵
PID:1712

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete
3⤵
PID:784

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete
3⤵
PID:1596

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete
3⤵
PID:1796

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete
3⤵
PID:1404

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete
2⤵
PID:1800

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete
3⤵
PID:1540

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete
2⤵
PID:1240

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete
3⤵
PID:468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-82-0x0000000000000000-mapping.dmp

Download
memory/560-69-0x0000000000000000-mapping.dmp

Download
memory/572-71-0x0000000000000000-mapping.dmp

Download
memory/784-72-0x0000000000000000-mapping.dmp

Download
memory/1048-61-0x0000000000000000-mapping.dmp

Download
memory/1048-77-0x0000000000000000-mapping.dmp

Download
memory/1240-81-0x0000000000000000-mapping.dmp

Download
memory/1288-66-0x0000000000000000-mapping.dmp

Download
memory/1304-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1320-65-0x0000000000000000-mapping.dmp

Download
memory/1376-75-0x0000000000000000-mapping.dmp

Download
memory/1404-78-0x0000000000000000-mapping.dmp

Download
memory/1440-67-0x0000000000000000-mapping.dmp

Download
memory/1540-80-0x0000000000000000-mapping.dmp

Download
memory/1596-74-0x0000000000000000-mapping.dmp

Download
memory/1600-68-0x0000000000000000-mapping.dmp

Download
memory/1624-73-0x0000000000000000-mapping.dmp

Download
memory/1712-70-0x0000000000000000-mapping.dmp

Download
memory/1764-63-0x0000000000000000-mapping.dmp

Download
memory/1796-76-0x0000000000000000-mapping.dmp

Download
memory/1800-79-0x0000000000000000-mapping.dmp

Download
memory/1888-64-0x0000000000000000-mapping.dmp

Download
memory/1992-62-0x0000000000000000-mapping.dmp

Download