Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 13:17
Static task
static1
Behavioral task
behavioral1
Sample
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe
Resource
win10-en-20210920
General
-
Target
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe
-
Size
190KB
-
MD5
19291cdb21a1f61831911640ff4836de
-
SHA1
e7cb534b81924f86f217a316b7d74df106a7c943
-
SHA256
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d
-
SHA512
ed27c74aac819f17c58d52afdd100367f9c7f49fbf23cbb6879677dfd0547d83d48026204a196834293b26f4f5cc1cd42267af2439215a27a174119f4dd1296b
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops startup file 1 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exedescription ioc process File opened for modification C:\Program Files (x86)\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Desktop\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Documents\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Documents\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Downloads\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Pictures\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Libraries\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Music\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\Videos\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Searches\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Public\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Music\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Videos\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Users\Admin\Links\desktop.ini d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Drops file in Program Files directory 64 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\bg.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightRegular.ttf d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_replace_signer_18.svg d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Stars.htm d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\PREVIEW.GIF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\AppStore_icon.svg d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTEXTRA.TTF d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\plugin.js d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\hr-hr\ui-strings.js d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\ui-strings.js d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare_k_col.hxk d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_18.svg d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_zh_HK.properties d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\id_get.svg d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Viewer.aapp d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jaccess.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-ae\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ui-strings.js d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\THMBNAIL.PNG d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql90.xsl d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\arrow-left.png d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File created C:\Program Files\Microsoft Office\root\vfs\System\readme.txt d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\ZY______.PFB d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\ui-strings.js d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Drops file in Windows directory 4 IoCs
Processes:
svchost.exeShellExperienceHost.exesvchost.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exepid process 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2720 vssvc.exe Token: SeRestorePrivilege 2720 vssvc.exe Token: SeAuditPrivilege 2720 vssvc.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe Token: 36 1644 WMIC.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe Token: 36 1644 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 3416 ShellExperienceHost.exe 3416 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.execmd.exedescription pid process target process PID 2372 wrote to memory of 1520 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 2372 wrote to memory of 1520 2372 d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe cmd.exe PID 1520 wrote to memory of 1644 1520 cmd.exe WMIC.exe PID 1520 wrote to memory of 1644 1520 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe"C:\Users\Admin\AppData\Local\Temp\d7868354f2dfe79e91adef4f7b24bcb60772a76c577bcc5c71709c8a3e26eb5d.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-115-0x0000000000000000-mapping.dmp
-
memory/1644-116-0x0000000000000000-mapping.dmp
-
memory/3576-118-0x000002616CFC0000-0x000002616CFD0000-memory.dmpFilesize
64KB
-
memory/3576-117-0x000002616CF60000-0x000002616CF70000-memory.dmpFilesize
64KB
-
memory/3576-119-0x000002616D8B0000-0x000002616D8B1000-memory.dmpFilesize
4KB