Analysis
-
max time kernel
116s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 13:09
Static task
static1
Behavioral task
behavioral1
Sample
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
Resource
win10-en-20210920
General
-
Target
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
-
Size
190KB
-
MD5
6da5a1163c3c8264134b3366521ef78a
-
SHA1
8dc13c56d1998ab44176361fb8f9389eca75f415
-
SHA256
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251
-
SHA512
5ead53b33ac55e2e14d64c14d6009d96dd62e468ad20270ca6b44658f557b91778b6a52a6124a9133d8d25a4d8155666f935c1c88b4650f3fd6738d0da4e7818
Malware Config
Extracted
C:\readme.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exedescription ioc process File renamed C:\Users\Admin\Pictures\ApproveSubmit.crw => C:\Users\Admin\Pictures\ApproveSubmit.crw.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\ConvertToExit.png => C:\Users\Admin\Pictures\ConvertToExit.png.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\JoinConfirm.png => C:\Users\Admin\Pictures\JoinConfirm.png.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Pictures\NewCompare.tiff 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\WriteCopy.raw => C:\Users\Admin\Pictures\WriteCopy.raw.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\BackupInvoke.raw => C:\Users\Admin\Pictures\BackupInvoke.raw.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\ExitExport.raw => C:\Users\Admin\Pictures\ExitExport.raw.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\HideEdit.png => C:\Users\Admin\Pictures\HideEdit.png.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\NewCompare.tiff => C:\Users\Admin\Pictures\NewCompare.tiff.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File renamed C:\Users\Admin\Pictures\StartUpdate.raw => C:\Users\Admin\Pictures\StartUpdate.raw.LKEED 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Drops startup file 1 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Music\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\VideoLAN\VLC\locale\ast\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\cs.pak 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Common Files\System\fr-FR\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfigOnLogon.xml 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\hijrah-config-umalqura.properties 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Toast.svg 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessCompare.rdlc 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\japanese_over.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\release 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\oledbvbs.inc 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\readme.txt 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Drops file in Windows directory 3 IoCs
Processes:
ShellExperienceHost.exesvchost.exedescription ioc process File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exepid process 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3020 vssvc.exe Token: SeRestorePrivilege 3020 vssvc.exe Token: SeAuditPrivilege 3020 vssvc.exe Token: SeIncreaseQuotaPrivilege 4088 WMIC.exe Token: SeSecurityPrivilege 4088 WMIC.exe Token: SeTakeOwnershipPrivilege 4088 WMIC.exe Token: SeLoadDriverPrivilege 4088 WMIC.exe Token: SeSystemProfilePrivilege 4088 WMIC.exe Token: SeSystemtimePrivilege 4088 WMIC.exe Token: SeProfSingleProcessPrivilege 4088 WMIC.exe Token: SeIncBasePriorityPrivilege 4088 WMIC.exe Token: SeCreatePagefilePrivilege 4088 WMIC.exe Token: SeBackupPrivilege 4088 WMIC.exe Token: SeRestorePrivilege 4088 WMIC.exe Token: SeShutdownPrivilege 4088 WMIC.exe Token: SeDebugPrivilege 4088 WMIC.exe Token: SeSystemEnvironmentPrivilege 4088 WMIC.exe Token: SeRemoteShutdownPrivilege 4088 WMIC.exe Token: SeUndockPrivilege 4088 WMIC.exe Token: SeManageVolumePrivilege 4088 WMIC.exe Token: 33 4088 WMIC.exe Token: 34 4088 WMIC.exe Token: 35 4088 WMIC.exe Token: 36 4088 WMIC.exe Token: SeIncreaseQuotaPrivilege 4088 WMIC.exe Token: SeSecurityPrivilege 4088 WMIC.exe Token: SeTakeOwnershipPrivilege 4088 WMIC.exe Token: SeLoadDriverPrivilege 4088 WMIC.exe Token: SeSystemProfilePrivilege 4088 WMIC.exe Token: SeSystemtimePrivilege 4088 WMIC.exe Token: SeProfSingleProcessPrivilege 4088 WMIC.exe Token: SeIncBasePriorityPrivilege 4088 WMIC.exe Token: SeCreatePagefilePrivilege 4088 WMIC.exe Token: SeBackupPrivilege 4088 WMIC.exe Token: SeRestorePrivilege 4088 WMIC.exe Token: SeShutdownPrivilege 4088 WMIC.exe Token: SeDebugPrivilege 4088 WMIC.exe Token: SeSystemEnvironmentPrivilege 4088 WMIC.exe Token: SeRemoteShutdownPrivilege 4088 WMIC.exe Token: SeUndockPrivilege 4088 WMIC.exe Token: SeManageVolumePrivilege 4088 WMIC.exe Token: 33 4088 WMIC.exe Token: 34 4088 WMIC.exe Token: 35 4088 WMIC.exe Token: 36 4088 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 2196 ShellExperienceHost.exe 2196 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exedescription pid process target process PID 2332 wrote to memory of 3292 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 2332 wrote to memory of 3292 2332 5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe cmd.exe PID 3292 wrote to memory of 4088 3292 cmd.exe WMIC.exe PID 3292 wrote to memory of 4088 3292 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe"C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3292-115-0x0000000000000000-mapping.dmp
-
memory/3760-117-0x000001C3007B0000-0x000001C3007C0000-memory.dmpFilesize
64KB
-
memory/3760-118-0x000001C300BD0000-0x000001C300BE0000-memory.dmpFilesize
64KB
-
memory/3760-119-0x000001C300CF0000-0x000001C300CF1000-memory.dmpFilesize
4KB
-
memory/4088-116-0x0000000000000000-mapping.dmp