5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251

General
Target

5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

Filesize

190KB

Completed

26-09-2021 13:12

Score
10 /10
MD5

6da5a1163c3c8264134b3366521ef78a

SHA1

8dc13c56d1998ab44176361fb8f9389eca75f415

SHA256

5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251

Malware Config

Extracted

Path C:\readme.txt
Family conti
Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion HTTPS VERSION : https://contirecovery.info YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- mEL9Y7SC22f1JfKAJi5NlYC2aVZ82ImX9nR568r2hXw9tn1weDwEc8s2r2thduYr ---END ID---
URLs

http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion

https://contirecovery.info

Signatures 8

Filter: none

Collection
Credential Access
  • Conti Ransomware

    Description

    Ransomware generally thought to be a successor to Ryuk.

  • Modifies extensions of user files
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File renamedC:\Users\Admin\Pictures\ConfirmOut.tiff => C:\Users\Admin\Pictures\ConfirmOut.tiff.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\CopyUnregister.tiff => C:\Users\Admin\Pictures\CopyUnregister.tiff.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\TestUnregister.crw => C:\Users\Admin\Pictures\TestUnregister.crw.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Pictures\ConfirmOut.tiff5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Pictures\CopyUnregister.tiff5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\InvokeBackup.png => C:\Users\Admin\Pictures\InvokeBackup.png.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\OpenMove.tif => C:\Users\Admin\Pictures\OpenMove.tif.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\PublishComplete.raw => C:\Users\Admin\Pictures\PublishComplete.raw.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\UseReset.tif => C:\Users\Admin\Pictures\UseReset.tif.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Drops desktop.ini file(s)
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Libraries\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Recorded TV\Sample Media\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Contacts\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Music\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Favorites\Links\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Links\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Pictures\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Favorites\Links for United States\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Music\Sample Music\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Videos\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Downloads\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Favorites\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Videos\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Documents\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Recorded TV\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Pictures\Sample Pictures\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Videos\Sample Videos\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Documents\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Searches\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Desktop\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Desktop\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Music\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Downloads\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Pictures\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Saved Games\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Drops file in Program Files directory
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21433_.GIF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Common Files\System\msadc\adcvbs.inc5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14870_.GIF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Australia\Currie5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18250_.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Asia\Tashkent5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\XLMACRO.CHM5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT98SP.POC5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.HXS5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\MSBuild\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0305257.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43B.GIF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01923_.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0318810.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Asia\Anadyr5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-25cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\Asia\Singapore5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DissolveAnother.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXC5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jre7\lib\zi\America\Montevideo5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00199_.WMF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\Java\jdk1.7.0_80\db\bin\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Suspicious behavior: EnumeratesProcesses
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Reported IOCs

    pidprocess
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    7605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Suspicious use of AdjustPrivilegeToken
    vssvc.exeWMIC.exeWMIC.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeBackupPrivilege1884vssvc.exe
    Token: SeRestorePrivilege1884vssvc.exe
    Token: SeAuditPrivilege1884vssvc.exe
    Token: SeIncreaseQuotaPrivilege860WMIC.exe
    Token: SeSecurityPrivilege860WMIC.exe
    Token: SeTakeOwnershipPrivilege860WMIC.exe
    Token: SeLoadDriverPrivilege860WMIC.exe
    Token: SeSystemProfilePrivilege860WMIC.exe
    Token: SeSystemtimePrivilege860WMIC.exe
    Token: SeProfSingleProcessPrivilege860WMIC.exe
    Token: SeIncBasePriorityPrivilege860WMIC.exe
    Token: SeCreatePagefilePrivilege860WMIC.exe
    Token: SeBackupPrivilege860WMIC.exe
    Token: SeRestorePrivilege860WMIC.exe
    Token: SeShutdownPrivilege860WMIC.exe
    Token: SeDebugPrivilege860WMIC.exe
    Token: SeSystemEnvironmentPrivilege860WMIC.exe
    Token: SeRemoteShutdownPrivilege860WMIC.exe
    Token: SeUndockPrivilege860WMIC.exe
    Token: SeManageVolumePrivilege860WMIC.exe
    Token: 33860WMIC.exe
    Token: 34860WMIC.exe
    Token: 35860WMIC.exe
    Token: SeIncreaseQuotaPrivilege860WMIC.exe
    Token: SeSecurityPrivilege860WMIC.exe
    Token: SeTakeOwnershipPrivilege860WMIC.exe
    Token: SeLoadDriverPrivilege860WMIC.exe
    Token: SeSystemProfilePrivilege860WMIC.exe
    Token: SeSystemtimePrivilege860WMIC.exe
    Token: SeProfSingleProcessPrivilege860WMIC.exe
    Token: SeIncBasePriorityPrivilege860WMIC.exe
    Token: SeCreatePagefilePrivilege860WMIC.exe
    Token: SeBackupPrivilege860WMIC.exe
    Token: SeRestorePrivilege860WMIC.exe
    Token: SeShutdownPrivilege860WMIC.exe
    Token: SeDebugPrivilege860WMIC.exe
    Token: SeSystemEnvironmentPrivilege860WMIC.exe
    Token: SeRemoteShutdownPrivilege860WMIC.exe
    Token: SeUndockPrivilege860WMIC.exe
    Token: SeManageVolumePrivilege860WMIC.exe
    Token: 33860WMIC.exe
    Token: 34860WMIC.exe
    Token: 35860WMIC.exe
    Token: SeIncreaseQuotaPrivilege1580WMIC.exe
    Token: SeSecurityPrivilege1580WMIC.exe
    Token: SeTakeOwnershipPrivilege1580WMIC.exe
    Token: SeLoadDriverPrivilege1580WMIC.exe
    Token: SeSystemProfilePrivilege1580WMIC.exe
    Token: SeSystemtimePrivilege1580WMIC.exe
    Token: SeProfSingleProcessPrivilege1580WMIC.exe
    Token: SeIncBasePriorityPrivilege1580WMIC.exe
    Token: SeCreatePagefilePrivilege1580WMIC.exe
    Token: SeBackupPrivilege1580WMIC.exe
    Token: SeRestorePrivilege1580WMIC.exe
    Token: SeShutdownPrivilege1580WMIC.exe
    Token: SeDebugPrivilege1580WMIC.exe
    Token: SeSystemEnvironmentPrivilege1580WMIC.exe
    Token: SeRemoteShutdownPrivilege1580WMIC.exe
    Token: SeUndockPrivilege1580WMIC.exe
    Token: SeManageVolumePrivilege1580WMIC.exe
    Token: 331580WMIC.exe
    Token: 341580WMIC.exe
    Token: 351580WMIC.exe
    Token: SeIncreaseQuotaPrivilege1580WMIC.exe
  • Suspicious use of WriteProcessMemory
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 760 wrote to memory of 13447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 13447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 13447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 13447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 1344 wrote to memory of 8601344cmd.exeWMIC.exe
    PID 1344 wrote to memory of 8601344cmd.exeWMIC.exe
    PID 1344 wrote to memory of 8601344cmd.exeWMIC.exe
    PID 760 wrote to memory of 16727605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16727605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16727605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16727605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 1672 wrote to memory of 15801672cmd.exeWMIC.exe
    PID 1672 wrote to memory of 15801672cmd.exeWMIC.exe
    PID 1672 wrote to memory of 15801672cmd.exeWMIC.exe
    PID 760 wrote to memory of 16847605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16847605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16847605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16847605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 1684 wrote to memory of 8161684cmd.exeWMIC.exe
    PID 1684 wrote to memory of 8161684cmd.exeWMIC.exe
    PID 1684 wrote to memory of 8161684cmd.exeWMIC.exe
    PID 760 wrote to memory of 10447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 10447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 10447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 10447605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 1044 wrote to memory of 4121044cmd.exeWMIC.exe
    PID 1044 wrote to memory of 4121044cmd.exeWMIC.exe
    PID 1044 wrote to memory of 4121044cmd.exeWMIC.exe
    PID 760 wrote to memory of 20087605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 20087605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 20087605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 20087605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 2008 wrote to memory of 19082008cmd.exeWMIC.exe
    PID 2008 wrote to memory of 19082008cmd.exeWMIC.exe
    PID 2008 wrote to memory of 19082008cmd.exeWMIC.exe
    PID 760 wrote to memory of 11607605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 11607605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 11607605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 11607605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 1160 wrote to memory of 16001160cmd.exeWMIC.exe
    PID 1160 wrote to memory of 16001160cmd.exeWMIC.exe
    PID 1160 wrote to memory of 16001160cmd.exeWMIC.exe
    PID 760 wrote to memory of 13527605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 13527605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 13527605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 13527605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 1352 wrote to memory of 12561352cmd.exeWMIC.exe
    PID 1352 wrote to memory of 12561352cmd.exeWMIC.exe
    PID 1352 wrote to memory of 12561352cmd.exeWMIC.exe
    PID 760 wrote to memory of 8247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 8247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 8247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 8247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 824 wrote to memory of 1456824cmd.exeWMIC.exe
    PID 824 wrote to memory of 1456824cmd.exeWMIC.exe
    PID 824 wrote to memory of 1456824cmd.exeWMIC.exe
    PID 760 wrote to memory of 16247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 760 wrote to memory of 16247605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 1624 wrote to memory of 6921624cmd.exeWMIC.exe
    PID 1624 wrote to memory of 6921624cmd.exeWMIC.exe
    PID 1624 wrote to memory of 6921624cmd.exeWMIC.exe
    PID 760 wrote to memory of 17607605cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
Processes 24
  • C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    "C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe"
    Modifies extensions of user files
    Drops desktop.ini file(s)
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:760
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete
      Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete
        Suspicious use of AdjustPrivilegeToken
        PID:860
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete
      Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete
        Suspicious use of AdjustPrivilegeToken
        PID:1580
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete
      Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete
        PID:816
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete
      Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete
        PID:412
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete
      Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete
        PID:1908
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete
      Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete
        PID:1600
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete
      Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete
        PID:1256
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete
      Suspicious use of WriteProcessMemory
      PID:824
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete
        PID:1456
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete
      Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete
        PID:692
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete
      PID:1760
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete
        PID:1768
    • C:\Windows\system32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete
      PID:2044
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete
        PID:1924
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:1884
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/412-67-0x0000000000000000-mapping.dmp

                      • memory/692-77-0x0000000000000000-mapping.dmp

                      • memory/760-59-0x0000000075051000-0x0000000075053000-memory.dmp

                      • memory/816-65-0x0000000000000000-mapping.dmp

                      • memory/824-74-0x0000000000000000-mapping.dmp

                      • memory/860-61-0x0000000000000000-mapping.dmp

                      • memory/1044-66-0x0000000000000000-mapping.dmp

                      • memory/1160-70-0x0000000000000000-mapping.dmp

                      • memory/1256-73-0x0000000000000000-mapping.dmp

                      • memory/1344-60-0x0000000000000000-mapping.dmp

                      • memory/1352-72-0x0000000000000000-mapping.dmp

                      • memory/1456-75-0x0000000000000000-mapping.dmp

                      • memory/1580-63-0x0000000000000000-mapping.dmp

                      • memory/1600-71-0x0000000000000000-mapping.dmp

                      • memory/1624-76-0x0000000000000000-mapping.dmp

                      • memory/1672-62-0x0000000000000000-mapping.dmp

                      • memory/1684-64-0x0000000000000000-mapping.dmp

                      • memory/1760-78-0x0000000000000000-mapping.dmp

                      • memory/1768-79-0x0000000000000000-mapping.dmp

                      • memory/1908-69-0x0000000000000000-mapping.dmp

                      • memory/1924-81-0x0000000000000000-mapping.dmp

                      • memory/2008-68-0x0000000000000000-mapping.dmp

                      • memory/2044-80-0x0000000000000000-mapping.dmp