5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251

General
Target

5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

Filesize

190KB

Completed

26-09-2021 13:11

Score
10 /10
MD5

6da5a1163c3c8264134b3366521ef78a

SHA1

8dc13c56d1998ab44176361fb8f9389eca75f415

SHA256

5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251

Malware Config

Extracted

Path C:\readme.txt
Family conti
Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion HTTPS VERSION : https://contirecovery.info YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- mEL9Y7SC22f1JfKAJi5NlYC2aVZ82ImX9nR568r2hXw9tn1weDwEc8s2r2thduYr ---END ID---
URLs

http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion

https://contirecovery.info

Signatures 11

Filter: none

Collection
Credential Access
  • Conti Ransomware

    Description

    Ransomware generally thought to be a successor to Ryuk.

  • Modifies extensions of user files
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File renamedC:\Users\Admin\Pictures\ApproveSubmit.crw => C:\Users\Admin\Pictures\ApproveSubmit.crw.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\ConvertToExit.png => C:\Users\Admin\Pictures\ConvertToExit.png.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\JoinConfirm.png => C:\Users\Admin\Pictures\JoinConfirm.png.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Pictures\NewCompare.tiff5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\WriteCopy.raw => C:\Users\Admin\Pictures\WriteCopy.raw.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\BackupInvoke.raw => C:\Users\Admin\Pictures\BackupInvoke.raw.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\ExitExport.raw => C:\Users\Admin\Pictures\ExitExport.raw.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\HideEdit.png => C:\Users\Admin\Pictures\HideEdit.png.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\NewCompare.tiff => C:\Users\Admin\Pictures\NewCompare.tiff.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File renamedC:\Users\Admin\Pictures\StartUpdate.raw => C:\Users\Admin\Pictures\StartUpdate.raw.LKEED5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Drops startup file
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Drops desktop.ini file(s)
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\Camera Roll\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Documents\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Downloads\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Pictures\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Saved Games\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Downloads\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Pictures\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Videos\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Desktop\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Videos\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Favorites\Links\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Documents\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Pictures\Saved Pictures\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Desktop\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Links\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\OneDrive\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Contacts\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Searches\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\AccountPictures\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Music\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Favorites\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Admin\Music\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Users\Public\Libraries\desktop.ini5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Drops file in Program Files directory
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\css\main.css5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ro-ro\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\VideoLAN\VLC\locale\ast\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\jre\lib\security\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ATPVBAEN.XLAM5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\cs.pak5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\dev\app-api.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-ae\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\hu-hu\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Common Files\System\fr-FR\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfigOnLogon.xml5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jre1.8.0_66\lib\hijrah-config-umalqura.properties5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check_2x.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ru-ru\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hr-hr\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\Toast.svg5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\uk-ua\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessCompare.rdlc5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\japanese_over.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\release5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files (x86)\Common Files\System\Ole DB\oledbvbs.inc5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File createdC:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\readme.txt5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ul-oob.xrm-ms5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    File opened for modificationC:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Drops file in Windows directory
    ShellExperienceHost.exesvchost.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\rescache\_merged\4032412167\2690874625.priShellExperienceHost.exe
    File opened for modificationC:\Windows\Debug\ESE.TXTsvchost.exe
    File createdC:\Windows\rescache\_merged\4183903823\1195458082.priShellExperienceHost.exe
  • Suspicious behavior: EnumeratesProcesses
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe

    Reported IOCs

    pidprocess
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    23325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
  • Suspicious use of AdjustPrivilegeToken
    vssvc.exeWMIC.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeBackupPrivilege3020vssvc.exe
    Token: SeRestorePrivilege3020vssvc.exe
    Token: SeAuditPrivilege3020vssvc.exe
    Token: SeIncreaseQuotaPrivilege4088WMIC.exe
    Token: SeSecurityPrivilege4088WMIC.exe
    Token: SeTakeOwnershipPrivilege4088WMIC.exe
    Token: SeLoadDriverPrivilege4088WMIC.exe
    Token: SeSystemProfilePrivilege4088WMIC.exe
    Token: SeSystemtimePrivilege4088WMIC.exe
    Token: SeProfSingleProcessPrivilege4088WMIC.exe
    Token: SeIncBasePriorityPrivilege4088WMIC.exe
    Token: SeCreatePagefilePrivilege4088WMIC.exe
    Token: SeBackupPrivilege4088WMIC.exe
    Token: SeRestorePrivilege4088WMIC.exe
    Token: SeShutdownPrivilege4088WMIC.exe
    Token: SeDebugPrivilege4088WMIC.exe
    Token: SeSystemEnvironmentPrivilege4088WMIC.exe
    Token: SeRemoteShutdownPrivilege4088WMIC.exe
    Token: SeUndockPrivilege4088WMIC.exe
    Token: SeManageVolumePrivilege4088WMIC.exe
    Token: 334088WMIC.exe
    Token: 344088WMIC.exe
    Token: 354088WMIC.exe
    Token: 364088WMIC.exe
    Token: SeIncreaseQuotaPrivilege4088WMIC.exe
    Token: SeSecurityPrivilege4088WMIC.exe
    Token: SeTakeOwnershipPrivilege4088WMIC.exe
    Token: SeLoadDriverPrivilege4088WMIC.exe
    Token: SeSystemProfilePrivilege4088WMIC.exe
    Token: SeSystemtimePrivilege4088WMIC.exe
    Token: SeProfSingleProcessPrivilege4088WMIC.exe
    Token: SeIncBasePriorityPrivilege4088WMIC.exe
    Token: SeCreatePagefilePrivilege4088WMIC.exe
    Token: SeBackupPrivilege4088WMIC.exe
    Token: SeRestorePrivilege4088WMIC.exe
    Token: SeShutdownPrivilege4088WMIC.exe
    Token: SeDebugPrivilege4088WMIC.exe
    Token: SeSystemEnvironmentPrivilege4088WMIC.exe
    Token: SeRemoteShutdownPrivilege4088WMIC.exe
    Token: SeUndockPrivilege4088WMIC.exe
    Token: SeManageVolumePrivilege4088WMIC.exe
    Token: 334088WMIC.exe
    Token: 344088WMIC.exe
    Token: 354088WMIC.exe
    Token: 364088WMIC.exe
  • Suspicious use of SetWindowsHookEx
    ShellExperienceHost.exe

    Reported IOCs

    pidprocess
    2196ShellExperienceHost.exe
    2196ShellExperienceHost.exe
  • Suspicious use of WriteProcessMemory
    5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2332 wrote to memory of 329223325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 2332 wrote to memory of 329223325cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.execmd.exe
    PID 3292 wrote to memory of 40883292cmd.exeWMIC.exe
    PID 3292 wrote to memory of 40883292cmd.exeWMIC.exe
Processes 6
  • C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe
    "C:\Users\Admin\AppData\Local\Temp\5cf0a6ac9786638a063eea9ab68508f31e537072bbcea27371f9121d2668a251.exe"
    Modifies extensions of user files
    Drops startup file
    Drops desktop.ini file(s)
    Drops file in Program Files directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete
      Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Windows\System32\wbem\WMIC.exe
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete
        Suspicious use of AdjustPrivilegeToken
        PID:4088
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:3020
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
    Drops file in Windows directory
    Suspicious use of SetWindowsHookEx
    PID:2196
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
    Drops file in Windows directory
    PID:3760
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/3292-115-0x0000000000000000-mapping.dmp

                      • memory/3760-117-0x000001C3007B0000-0x000001C3007C0000-memory.dmp

                      • memory/3760-118-0x000001C300BD0000-0x000001C300BE0000-memory.dmp

                      • memory/3760-119-0x000001C300CF0000-0x000001C300CF1000-memory.dmp

                      • memory/4088-116-0x0000000000000000-mapping.dmp