Analysis
-
max time kernel
112s -
max time network
60s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-09-2021 13:09
Static task
static1
Behavioral task
behavioral1
Sample
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
Resource
win10-en-20210920
General
-
Target
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
-
Size
190KB
-
MD5
6da5a1163c3c8264134b3366521ef78a
-
SHA1
8dc13c56d1998ab44176361fb8f9389eca75f415
-
SHA256
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251
-
SHA512
5ead53b33ac55e2e14d64c14d6009d96dd62e468ad20270ca6b44658f557b91778b6a52a6124a9133d8d25a4d8155666f935c1c88b4650f3fd6738d0da4e7818
Malware Config
Extracted
C:\readme.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConfirmOut.tiff => C:\Users\Admin\Pictures\ConfirmOut.tiff.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\CopyUnregister.tiff => C:\Users\Admin\Pictures\CopyUnregister.tiff.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\TestUnregister.crw => C:\Users\Admin\Pictures\TestUnregister.crw.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Pictures\ConfirmOut.tiff 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Pictures\CopyUnregister.tiff 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\InvokeBackup.png => C:\Users\Admin\Pictures\InvokeBackup.png.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\OpenMove.tif => C:\Users\Admin\Pictures\OpenMove.tif.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\PublishComplete.raw => C:\Users\Admin\Pictures\PublishComplete.raw.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\UseReset.tif => C:\Users\Admin\Pictures\UseReset.tif.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Music\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21433_.GIF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14870_.GIF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Currie 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18250_.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XLMACRO.CHM 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT98SP.POC 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.HXS 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\MSBuild\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0305257.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43B.GIF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0318810.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveAnother.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXC 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montevideo 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exepid process 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1884 vssvc.exe Token: SeRestorePrivilege 1884 vssvc.exe Token: SeAuditPrivilege 1884 vssvc.exe Token: SeIncreaseQuotaPrivilege 860 WMIC.exe Token: SeSecurityPrivilege 860 WMIC.exe Token: SeTakeOwnershipPrivilege 860 WMIC.exe Token: SeLoadDriverPrivilege 860 WMIC.exe Token: SeSystemProfilePrivilege 860 WMIC.exe Token: SeSystemtimePrivilege 860 WMIC.exe Token: SeProfSingleProcessPrivilege 860 WMIC.exe Token: SeIncBasePriorityPrivilege 860 WMIC.exe Token: SeCreatePagefilePrivilege 860 WMIC.exe Token: SeBackupPrivilege 860 WMIC.exe Token: SeRestorePrivilege 860 WMIC.exe Token: SeShutdownPrivilege 860 WMIC.exe Token: SeDebugPrivilege 860 WMIC.exe Token: SeSystemEnvironmentPrivilege 860 WMIC.exe Token: SeRemoteShutdownPrivilege 860 WMIC.exe Token: SeUndockPrivilege 860 WMIC.exe Token: SeManageVolumePrivilege 860 WMIC.exe Token: 33 860 WMIC.exe Token: 34 860 WMIC.exe Token: 35 860 WMIC.exe Token: SeIncreaseQuotaPrivilege 860 WMIC.exe Token: SeSecurityPrivilege 860 WMIC.exe Token: SeTakeOwnershipPrivilege 860 WMIC.exe Token: SeLoadDriverPrivilege 860 WMIC.exe Token: SeSystemProfilePrivilege 860 WMIC.exe Token: SeSystemtimePrivilege 860 WMIC.exe Token: SeProfSingleProcessPrivilege 860 WMIC.exe Token: SeIncBasePriorityPrivilege 860 WMIC.exe Token: SeCreatePagefilePrivilege 860 WMIC.exe Token: SeBackupPrivilege 860 WMIC.exe Token: SeRestorePrivilege 860 WMIC.exe Token: SeShutdownPrivilege 860 WMIC.exe Token: SeDebugPrivilege 860 WMIC.exe Token: SeSystemEnvironmentPrivilege 860 WMIC.exe Token: SeRemoteShutdownPrivilege 860 WMIC.exe Token: SeUndockPrivilege 860 WMIC.exe Token: SeManageVolumePrivilege 860 WMIC.exe Token: 33 860 WMIC.exe Token: 34 860 WMIC.exe Token: 35 860 WMIC.exe Token: SeIncreaseQuotaPrivilege 1580 WMIC.exe Token: SeSecurityPrivilege 1580 WMIC.exe Token: SeTakeOwnershipPrivilege 1580 WMIC.exe Token: SeLoadDriverPrivilege 1580 WMIC.exe Token: SeSystemProfilePrivilege 1580 WMIC.exe Token: SeSystemtimePrivilege 1580 WMIC.exe Token: SeProfSingleProcessPrivilege 1580 WMIC.exe Token: SeIncBasePriorityPrivilege 1580 WMIC.exe Token: SeCreatePagefilePrivilege 1580 WMIC.exe Token: SeBackupPrivilege 1580 WMIC.exe Token: SeRestorePrivilege 1580 WMIC.exe Token: SeShutdownPrivilege 1580 WMIC.exe Token: SeDebugPrivilege 1580 WMIC.exe Token: SeSystemEnvironmentPrivilege 1580 WMIC.exe Token: SeRemoteShutdownPrivilege 1580 WMIC.exe Token: SeUndockPrivilege 1580 WMIC.exe Token: SeManageVolumePrivilege 1580 WMIC.exe Token: 33 1580 WMIC.exe Token: 34 1580 WMIC.exe Token: 35 1580 WMIC.exe Token: SeIncreaseQuotaPrivilege 1580 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 760 wrote to memory of 1344 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1344 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1344 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1344 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 1344 wrote to memory of 860 1344 cmd.exe WMIC.exe PID 1344 wrote to memory of 860 1344 cmd.exe WMIC.exe PID 1344 wrote to memory of 860 1344 cmd.exe WMIC.exe PID 760 wrote to memory of 1672 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1672 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1672 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1672 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 1672 wrote to memory of 1580 1672 cmd.exe WMIC.exe PID 1672 wrote to memory of 1580 1672 cmd.exe WMIC.exe PID 1672 wrote to memory of 1580 1672 cmd.exe WMIC.exe PID 760 wrote to memory of 1684 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1684 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1684 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1684 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 1684 wrote to memory of 816 1684 cmd.exe WMIC.exe PID 1684 wrote to memory of 816 1684 cmd.exe WMIC.exe PID 1684 wrote to memory of 816 1684 cmd.exe WMIC.exe PID 760 wrote to memory of 1044 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1044 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1044 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1044 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 1044 wrote to memory of 412 1044 cmd.exe WMIC.exe PID 1044 wrote to memory of 412 1044 cmd.exe WMIC.exe PID 1044 wrote to memory of 412 1044 cmd.exe WMIC.exe PID 760 wrote to memory of 2008 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 2008 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 2008 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 2008 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 2008 wrote to memory of 1908 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1908 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1908 2008 cmd.exe WMIC.exe PID 760 wrote to memory of 1160 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1160 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1160 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1160 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 1160 wrote to memory of 1600 1160 cmd.exe WMIC.exe PID 1160 wrote to memory of 1600 1160 cmd.exe WMIC.exe PID 1160 wrote to memory of 1600 1160 cmd.exe WMIC.exe PID 760 wrote to memory of 1352 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1352 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1352 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1352 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 1352 wrote to memory of 1256 1352 cmd.exe WMIC.exe PID 1352 wrote to memory of 1256 1352 cmd.exe WMIC.exe PID 1352 wrote to memory of 1256 1352 cmd.exe WMIC.exe PID 760 wrote to memory of 824 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 824 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 824 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 824 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 824 wrote to memory of 1456 824 cmd.exe WMIC.exe PID 824 wrote to memory of 1456 824 cmd.exe WMIC.exe PID 824 wrote to memory of 1456 824 cmd.exe WMIC.exe PID 760 wrote to memory of 1624 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1624 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1624 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 760 wrote to memory of 1624 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 1624 wrote to memory of 692 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 692 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 692 1624 cmd.exe WMIC.exe PID 760 wrote to memory of 1760 760 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe"C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/412-67-0x0000000000000000-mapping.dmp
-
memory/692-77-0x0000000000000000-mapping.dmp
-
memory/760-59-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/816-65-0x0000000000000000-mapping.dmp
-
memory/824-74-0x0000000000000000-mapping.dmp
-
memory/860-61-0x0000000000000000-mapping.dmp
-
memory/1044-66-0x0000000000000000-mapping.dmp
-
memory/1160-70-0x0000000000000000-mapping.dmp
-
memory/1256-73-0x0000000000000000-mapping.dmp
-
memory/1344-60-0x0000000000000000-mapping.dmp
-
memory/1352-72-0x0000000000000000-mapping.dmp
-
memory/1456-75-0x0000000000000000-mapping.dmp
-
memory/1580-63-0x0000000000000000-mapping.dmp
-
memory/1600-71-0x0000000000000000-mapping.dmp
-
memory/1624-76-0x0000000000000000-mapping.dmp
-
memory/1672-62-0x0000000000000000-mapping.dmp
-
memory/1684-64-0x0000000000000000-mapping.dmp
-
memory/1760-78-0x0000000000000000-mapping.dmp
-
memory/1768-79-0x0000000000000000-mapping.dmp
-
memory/1908-69-0x0000000000000000-mapping.dmp
-
memory/1924-81-0x0000000000000000-mapping.dmp
-
memory/2008-68-0x0000000000000000-mapping.dmp
-
memory/2044-80-0x0000000000000000-mapping.dmp