Overview
overview
10Static
static
81814a6a674...67.exe
windows7_x64
31814a6a674...67.exe
windows10_x64
102ca4f97e15...51.exe
windows7_x64
102ca4f97e15...51.exe
windows10_x64
103db6e8df73...3b.dll
windows7_x64
103db6e8df73...3b.dll
windows10_x64
103e2ce6fd7b...a5.exe
windows7_x64
103e2ce6fd7b...a5.exe
windows10_x64
10463b34821a...40.exe
windows7_x64
10463b34821a...40.exe
windows10_x64
34f4a33f700...72.exe
windows7_x64
104f4a33f700...72.exe
windows10_x64
853b1c1b2f4...22.exe
windows7_x64
1053b1c1b2f4...22.exe
windows10_x64
1062b2822215...d3.exe
windows7_x64
962b2822215...d3.exe
windows10_x64
96bc6f60b87...bc.dll
windows7_x64
106bc6f60b87...bc.dll
windows10_x64
106f7043b24d...1d.dll
windows7_x64
16f7043b24d...1d.dll
windows10_x64
3706a8a4fc4...1c.exe
windows7_x64
10706a8a4fc4...1c.exe
windows10_x64
107236c8098c...8e.exe
windows7_x64
107236c8098c...8e.exe
windows10_x64
1074ebfcd116...dd.dll
windows7_x64
1074ebfcd116...dd.dll
windows10_x64
107fbeac1dca...de.exe
windows7_x64
107fbeac1dca...de.exe
windows10_x64
1087e6f7b20e...89.exe
windows7_x64
387e6f7b20e...89.exe
windows10_x64
3918127c59e...3d.exe
windows7_x64
10918127c59e...3d.exe
windows10_x64
10Analysis
-
max time kernel
155s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-09-2021 10:27
Behavioral task
behavioral1
Sample
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral2
Sample
1814a6a6749684cdacd792374e0ba31b7be4ff6f9675f3fd15d543afbb540367.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral3
Sample
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral4
Sample
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral5
Sample
3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral6
Sample
3db6e8df73f12b6a9fa9adb6ad87b017d530a9d736909338042735ed00a9463b.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral7
Sample
3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral8
Sample
3e2ce6fd7b53224df92581b800ce9a6605eae878d4165df9ae8f73a488be3fa5.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral9
Sample
463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral10
Sample
463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral11
Sample
4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral12
Sample
4f4a33f70099855f5f503716515f388da3a5daa1e2fac59ec6c881e89ef7d072.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral13
Sample
53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral14
Sample
53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral15
Sample
62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral16
Sample
62b28222159f1b1abe80bec49c89444448c41623a93895afafb7563fe82ffdd3.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral17
Sample
6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral18
Sample
6bc6f60b873ea406022459edcd2df278cb2ec7bb4d994ebd4fc02af3a57ec6bc.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral19
Sample
6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral20
Sample
6f7043b24d9b4c30006781402f0cef2543c8f3e9087d79f6bcff43b1418ad21d.dll
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral21
Sample
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral22
Sample
706a8a4fc4b9f8b15c6bf1ee0fe732eaa5e069615ea126b931166672a8a5b51c.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral23
Sample
7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral24
Sample
7236c8098c55ea1d144f4d6646e8cab8c7fdbde1d127d409b0d6a4ff1029628e.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral25
Sample
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral26
Sample
74ebfcd116fdd39217935d11ae62e48a0c44dfab822edea62ac7f611aca969dd.dll
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral27
Sample
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
Resource
win7v20210408
windows7_x64
Behavioral task
behavioral28
Sample
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de.exe
Resource
win10-en-20210920
windows10_x64
Behavioral task
behavioral29
Sample
87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral30
Sample
87e6f7b20ea2bd35d947d9100fe6291dfe186cfedea5d451be14bab5d2518e89.exe
Resource
win10v20210408
windows10_x64
Behavioral task
behavioral31
Sample
918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe
Resource
win7-en-20210920
windows7_x64
Behavioral task
behavioral32
Sample
918127c59ea7d9c0095a0add9bc93739a393d9fd64132446e7997952db07f93d.exe
Resource
win10v20210408
windows10_x64
General
-
Target
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe
-
Size
195KB
-
MD5
2c550ec2c56516e19f88a5228b1e4555
-
SHA1
31801a310f5aad8154f8b3e69027f068c76152f4
-
SHA256
2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751
-
SHA512
b52a93a5a8feeabc3c5f23a208c7cecfe8a619dd73c45c1126796269f5aa67e36594d9a47e1fca974ff9685d7421189a33fd33e1addd89e9bfbca3bca6573d45
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Microsoft Sync Framework\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\PingUpdate.iso 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\SearchCompare.mpeg2 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Adobe\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\7-Zip\History.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\Common Files\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\Google\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\ConfirmRequest.M2V 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\StepUndo.crw 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\GroupRevoke.cmd 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\JoinRegister.eprtx 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\RestoreReset.emf 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\7-Zip\descript.ion 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\Internet Explorer\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\Reference Assemblies\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\VideoLAN\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Common Files\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\directshowtap.ax 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\MSBuild\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Google\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\MSBuild\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\HideUse.rle 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\InstallLock.vssm 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\MergeProtect.crw 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\PublishConfirm.dib 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\ConfirmConvertFrom.m3u 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\WatchResume.asp 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\7-Zip\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\CheckpointUse.hta 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\NewConnect.pub 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\NewUnprotect.ADT 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\DVD Maker\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\Microsoft Office\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files\Mozilla Firefox\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\ConvertFromReceive.pps 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 1548 vssvc.exe Token: SeRestorePrivilege 1548 vssvc.exe Token: SeAuditPrivilege 1548 vssvc.exe Token: SeIncreaseQuotaPrivilege 556 WMIC.exe Token: SeSecurityPrivilege 556 WMIC.exe Token: SeTakeOwnershipPrivilege 556 WMIC.exe Token: SeLoadDriverPrivilege 556 WMIC.exe Token: SeSystemProfilePrivilege 556 WMIC.exe Token: SeSystemtimePrivilege 556 WMIC.exe Token: SeProfSingleProcessPrivilege 556 WMIC.exe Token: SeIncBasePriorityPrivilege 556 WMIC.exe Token: SeCreatePagefilePrivilege 556 WMIC.exe Token: SeBackupPrivilege 556 WMIC.exe Token: SeRestorePrivilege 556 WMIC.exe Token: SeShutdownPrivilege 556 WMIC.exe Token: SeDebugPrivilege 556 WMIC.exe Token: SeSystemEnvironmentPrivilege 556 WMIC.exe Token: SeRemoteShutdownPrivilege 556 WMIC.exe Token: SeUndockPrivilege 556 WMIC.exe Token: SeManageVolumePrivilege 556 WMIC.exe Token: 33 556 WMIC.exe Token: 34 556 WMIC.exe Token: 35 556 WMIC.exe Token: SeIncreaseQuotaPrivilege 556 WMIC.exe Token: SeSecurityPrivilege 556 WMIC.exe Token: SeTakeOwnershipPrivilege 556 WMIC.exe Token: SeLoadDriverPrivilege 556 WMIC.exe Token: SeSystemProfilePrivilege 556 WMIC.exe Token: SeSystemtimePrivilege 556 WMIC.exe Token: SeProfSingleProcessPrivilege 556 WMIC.exe Token: SeIncBasePriorityPrivilege 556 WMIC.exe Token: SeCreatePagefilePrivilege 556 WMIC.exe Token: SeBackupPrivilege 556 WMIC.exe Token: SeRestorePrivilege 556 WMIC.exe Token: SeShutdownPrivilege 556 WMIC.exe Token: SeDebugPrivilege 556 WMIC.exe Token: SeSystemEnvironmentPrivilege 556 WMIC.exe Token: SeRemoteShutdownPrivilege 556 WMIC.exe Token: SeUndockPrivilege 556 WMIC.exe Token: SeManageVolumePrivilege 556 WMIC.exe Token: 33 556 WMIC.exe Token: 34 556 WMIC.exe Token: 35 556 WMIC.exe Token: SeIncreaseQuotaPrivilege 1196 WMIC.exe Token: SeSecurityPrivilege 1196 WMIC.exe Token: SeTakeOwnershipPrivilege 1196 WMIC.exe Token: SeLoadDriverPrivilege 1196 WMIC.exe Token: SeSystemProfilePrivilege 1196 WMIC.exe Token: SeSystemtimePrivilege 1196 WMIC.exe Token: SeProfSingleProcessPrivilege 1196 WMIC.exe Token: SeIncBasePriorityPrivilege 1196 WMIC.exe Token: SeCreatePagefilePrivilege 1196 WMIC.exe Token: SeBackupPrivilege 1196 WMIC.exe Token: SeRestorePrivilege 1196 WMIC.exe Token: SeShutdownPrivilege 1196 WMIC.exe Token: SeDebugPrivilege 1196 WMIC.exe Token: SeSystemEnvironmentPrivilege 1196 WMIC.exe Token: SeRemoteShutdownPrivilege 1196 WMIC.exe Token: SeUndockPrivilege 1196 WMIC.exe Token: SeManageVolumePrivilege 1196 WMIC.exe Token: 33 1196 WMIC.exe Token: 34 1196 WMIC.exe Token: 35 1196 WMIC.exe Token: SeIncreaseQuotaPrivilege 1196 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1468 wrote to memory of 428 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 30 PID 1468 wrote to memory of 428 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 30 PID 1468 wrote to memory of 428 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 30 PID 1468 wrote to memory of 428 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 30 PID 428 wrote to memory of 556 428 cmd.exe 32 PID 428 wrote to memory of 556 428 cmd.exe 32 PID 428 wrote to memory of 556 428 cmd.exe 32 PID 1468 wrote to memory of 508 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 33 PID 1468 wrote to memory of 508 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 33 PID 1468 wrote to memory of 508 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 33 PID 1468 wrote to memory of 508 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 33 PID 508 wrote to memory of 1196 508 cmd.exe 35 PID 508 wrote to memory of 1196 508 cmd.exe 35 PID 508 wrote to memory of 1196 508 cmd.exe 35 PID 1468 wrote to memory of 1584 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 36 PID 1468 wrote to memory of 1584 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 36 PID 1468 wrote to memory of 1584 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 36 PID 1468 wrote to memory of 1584 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 36 PID 1584 wrote to memory of 604 1584 cmd.exe 38 PID 1584 wrote to memory of 604 1584 cmd.exe 38 PID 1584 wrote to memory of 604 1584 cmd.exe 38 PID 1468 wrote to memory of 1032 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 39 PID 1468 wrote to memory of 1032 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 39 PID 1468 wrote to memory of 1032 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 39 PID 1468 wrote to memory of 1032 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 39 PID 1032 wrote to memory of 1152 1032 cmd.exe 41 PID 1032 wrote to memory of 1152 1032 cmd.exe 41 PID 1032 wrote to memory of 1152 1032 cmd.exe 41 PID 1468 wrote to memory of 1336 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 42 PID 1468 wrote to memory of 1336 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 42 PID 1468 wrote to memory of 1336 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 42 PID 1468 wrote to memory of 1336 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 42 PID 1336 wrote to memory of 1692 1336 cmd.exe 44 PID 1336 wrote to memory of 1692 1336 cmd.exe 44 PID 1336 wrote to memory of 1692 1336 cmd.exe 44 PID 1468 wrote to memory of 784 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 45 PID 1468 wrote to memory of 784 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 45 PID 1468 wrote to memory of 784 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 45 PID 1468 wrote to memory of 784 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 45 PID 784 wrote to memory of 1748 784 cmd.exe 47 PID 784 wrote to memory of 1748 784 cmd.exe 47 PID 784 wrote to memory of 1748 784 cmd.exe 47 PID 1468 wrote to memory of 928 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 48 PID 1468 wrote to memory of 928 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 48 PID 1468 wrote to memory of 928 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 48 PID 1468 wrote to memory of 928 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 48 PID 928 wrote to memory of 1280 928 cmd.exe 50 PID 928 wrote to memory of 1280 928 cmd.exe 50 PID 928 wrote to memory of 1280 928 cmd.exe 50 PID 1468 wrote to memory of 892 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 51 PID 1468 wrote to memory of 892 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 51 PID 1468 wrote to memory of 892 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 51 PID 1468 wrote to memory of 892 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 51 PID 892 wrote to memory of 460 892 cmd.exe 53 PID 892 wrote to memory of 460 892 cmd.exe 53 PID 892 wrote to memory of 460 892 cmd.exe 53 PID 1468 wrote to memory of 1504 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 54 PID 1468 wrote to memory of 1504 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 54 PID 1468 wrote to memory of 1504 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 54 PID 1468 wrote to memory of 1504 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 54 PID 1504 wrote to memory of 1512 1504 cmd.exe 56 PID 1504 wrote to memory of 1512 1504 cmd.exe 56 PID 1504 wrote to memory of 1512 1504 cmd.exe 56 PID 1468 wrote to memory of 1416 1468 2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe 57
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe"C:\Users\Admin\AppData\Local\Temp\2ca4f97e15c6ddaa3276fbc56e716249dde1d2607f3b745933fedd9df3879751.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵PID:604
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵PID:1152
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵PID:1692
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵PID:1748
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵PID:1280
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵PID:460
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵PID:1512
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵PID:1416
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵PID:868
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵PID:1044
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵PID:1584
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵PID:1800
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵PID:1032
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548