Analysis
-
max time kernel
86s -
max time network
48s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-09-2021 13:17
Static task
static1
Behavioral task
behavioral1
Sample
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe
Resource
win10-en-20210920
General
-
Target
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe
-
Size
190KB
-
MD5
19291cdb21a1f61831911640ff4836de
-
SHA1
e7cb534b81924f86f217a316b7d74df106a7c943
-
SHA256
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d
-
SHA512
ed27c74aac819f17c58d52afdd100367f9c7f49fbf23cbb6879677dfd0547d83d48026204a196834293b26f4f5cc1cd42267af2439215a27a174119f4dd1296b
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exedescription ioc process File renamed C:\Users\Admin\Pictures\JoinInitialize.png => C:\Users\Admin\Pictures\JoinInitialize.png.SJEJN d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File renamed C:\Users\Admin\Pictures\ConnectUnprotect.png => C:\Users\Admin\Pictures\ConnectUnprotect.png.SJEJN d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File renamed C:\Users\Admin\Pictures\EnterEdit.tif => C:\Users\Admin\Pictures\EnterEdit.tif.SJEJN d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File renamed C:\Users\Admin\Pictures\JoinClear.png => C:\Users\Admin\Pictures\JoinClear.png.SJEJN d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Videos\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Music\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Music\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Links\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Documents\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exedescription ioc process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.PPD d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21323_.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21520_.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\QRCode.pmp d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_F_COL.HXK d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBPQT.DPV d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Antigua d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00252_.WMF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01293_.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7EN.LEX d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-templates.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105526.WMF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\VSTARemotingServer.tlb d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\de.pak d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Phoenix d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\background.gif d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Trek.eftx d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10268_.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33F.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WITHCOMP.XML d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143748.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105520.WMF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Composite.thmx d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BORDERBB.POC d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Xlate_Init.xsn d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR6B.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186364.WMF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03513_.WMF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jre7\lib\plugin.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105276.WMF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exepid process 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1172 vssvc.exe Token: SeRestorePrivilege 1172 vssvc.exe Token: SeAuditPrivilege 1172 vssvc.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe Token: SeShutdownPrivilege 1064 WMIC.exe Token: SeDebugPrivilege 1064 WMIC.exe Token: SeSystemEnvironmentPrivilege 1064 WMIC.exe Token: SeRemoteShutdownPrivilege 1064 WMIC.exe Token: SeUndockPrivilege 1064 WMIC.exe Token: SeManageVolumePrivilege 1064 WMIC.exe Token: 33 1064 WMIC.exe Token: 34 1064 WMIC.exe Token: 35 1064 WMIC.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe Token: SeShutdownPrivilege 1064 WMIC.exe Token: SeDebugPrivilege 1064 WMIC.exe Token: SeSystemEnvironmentPrivilege 1064 WMIC.exe Token: SeRemoteShutdownPrivilege 1064 WMIC.exe Token: SeUndockPrivilege 1064 WMIC.exe Token: SeManageVolumePrivilege 1064 WMIC.exe Token: 33 1064 WMIC.exe Token: 34 1064 WMIC.exe Token: 35 1064 WMIC.exe Token: SeIncreaseQuotaPrivilege 1888 WMIC.exe Token: SeSecurityPrivilege 1888 WMIC.exe Token: SeTakeOwnershipPrivilege 1888 WMIC.exe Token: SeLoadDriverPrivilege 1888 WMIC.exe Token: SeSystemProfilePrivilege 1888 WMIC.exe Token: SeSystemtimePrivilege 1888 WMIC.exe Token: SeProfSingleProcessPrivilege 1888 WMIC.exe Token: SeIncBasePriorityPrivilege 1888 WMIC.exe Token: SeCreatePagefilePrivilege 1888 WMIC.exe Token: SeBackupPrivilege 1888 WMIC.exe Token: SeRestorePrivilege 1888 WMIC.exe Token: SeShutdownPrivilege 1888 WMIC.exe Token: SeDebugPrivilege 1888 WMIC.exe Token: SeSystemEnvironmentPrivilege 1888 WMIC.exe Token: SeRemoteShutdownPrivilege 1888 WMIC.exe Token: SeUndockPrivilege 1888 WMIC.exe Token: SeManageVolumePrivilege 1888 WMIC.exe Token: 33 1888 WMIC.exe Token: 34 1888 WMIC.exe Token: 35 1888 WMIC.exe Token: SeIncreaseQuotaPrivilege 1888 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1356 wrote to memory of 648 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 648 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 648 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 648 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 648 wrote to memory of 1064 648 cmd.exe WMIC.exe PID 648 wrote to memory of 1064 648 cmd.exe WMIC.exe PID 648 wrote to memory of 1064 648 cmd.exe WMIC.exe PID 1356 wrote to memory of 984 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 984 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 984 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 984 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 984 wrote to memory of 1888 984 cmd.exe WMIC.exe PID 984 wrote to memory of 1888 984 cmd.exe WMIC.exe PID 984 wrote to memory of 1888 984 cmd.exe WMIC.exe PID 1356 wrote to memory of 1312 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1312 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1312 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1312 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1312 wrote to memory of 1820 1312 cmd.exe WMIC.exe PID 1312 wrote to memory of 1820 1312 cmd.exe WMIC.exe PID 1312 wrote to memory of 1820 1312 cmd.exe WMIC.exe PID 1356 wrote to memory of 1156 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1156 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1156 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1156 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1156 wrote to memory of 1808 1156 cmd.exe WMIC.exe PID 1156 wrote to memory of 1808 1156 cmd.exe WMIC.exe PID 1156 wrote to memory of 1808 1156 cmd.exe WMIC.exe PID 1356 wrote to memory of 1940 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1940 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1940 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1940 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1940 wrote to memory of 1564 1940 cmd.exe WMIC.exe PID 1940 wrote to memory of 1564 1940 cmd.exe WMIC.exe PID 1940 wrote to memory of 1564 1940 cmd.exe WMIC.exe PID 1356 wrote to memory of 1152 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1152 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1152 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1152 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1152 wrote to memory of 1708 1152 cmd.exe WMIC.exe PID 1152 wrote to memory of 1708 1152 cmd.exe WMIC.exe PID 1152 wrote to memory of 1708 1152 cmd.exe WMIC.exe PID 1356 wrote to memory of 1388 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1388 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1388 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1388 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1388 wrote to memory of 1612 1388 cmd.exe WMIC.exe PID 1388 wrote to memory of 1612 1388 cmd.exe WMIC.exe PID 1388 wrote to memory of 1612 1388 cmd.exe WMIC.exe PID 1356 wrote to memory of 564 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 564 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 564 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 564 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 564 wrote to memory of 664 564 cmd.exe WMIC.exe PID 564 wrote to memory of 664 564 cmd.exe WMIC.exe PID 564 wrote to memory of 664 564 cmd.exe WMIC.exe PID 1356 wrote to memory of 1784 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1784 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1784 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1356 wrote to memory of 1784 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1784 wrote to memory of 628 1784 cmd.exe WMIC.exe PID 1784 wrote to memory of 628 1784 cmd.exe WMIC.exe PID 1784 wrote to memory of 628 1784 cmd.exe WMIC.exe PID 1356 wrote to memory of 1092 1356 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe"C:\Users\Admin\AppData\Local\Temp\d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-73-0x0000000000000000-mapping.dmp
-
memory/564-68-0x0000000000000000-mapping.dmp
-
memory/628-71-0x0000000000000000-mapping.dmp
-
memory/648-54-0x0000000000000000-mapping.dmp
-
memory/664-69-0x0000000000000000-mapping.dmp
-
memory/984-56-0x0000000000000000-mapping.dmp
-
memory/1064-55-0x0000000000000000-mapping.dmp
-
memory/1092-72-0x0000000000000000-mapping.dmp
-
memory/1152-64-0x0000000000000000-mapping.dmp
-
memory/1156-60-0x0000000000000000-mapping.dmp
-
memory/1312-58-0x0000000000000000-mapping.dmp
-
memory/1356-53-0x0000000076A81000-0x0000000076A83000-memory.dmpFilesize
8KB
-
memory/1388-66-0x0000000000000000-mapping.dmp
-
memory/1536-74-0x0000000000000000-mapping.dmp
-
memory/1564-63-0x0000000000000000-mapping.dmp
-
memory/1612-67-0x0000000000000000-mapping.dmp
-
memory/1708-65-0x0000000000000000-mapping.dmp
-
memory/1748-77-0x0000000000000000-mapping.dmp
-
memory/1784-70-0x0000000000000000-mapping.dmp
-
memory/1808-61-0x0000000000000000-mapping.dmp
-
memory/1808-75-0x0000000000000000-mapping.dmp
-
memory/1816-76-0x0000000000000000-mapping.dmp
-
memory/1820-59-0x0000000000000000-mapping.dmp
-
memory/1888-57-0x0000000000000000-mapping.dmp
-
memory/1940-62-0x0000000000000000-mapping.dmp