Analysis
-
max time kernel
138s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 08:14
Static task
static1
Behavioral task
behavioral1
Sample
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe
-
Size
190KB
-
MD5
419af91172833a6510b63d2a943e66b5
-
SHA1
df341a704f1a38cfa8658e60f945e94624387d65
-
SHA256
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132
-
SHA512
16a73062c6f1b63a7b68f516c92ad66e22a24566fa69ae0c2fa1891883fb296324719e736b8afb51c25f90dde053ff0ff2a8c5c95e0bf6c33ade521240c06ba7
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\PublishOut.png => C:\Users\Admin\Pictures\PublishOut.png.NOGKN ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File renamed C:\Users\Admin\Pictures\StartConnect.crw => C:\Users\Admin\Pictures\StartConnect.crw.NOGKN ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectOpen.crw => C:\Users\Admin\Pictures\UnprotectOpen.crw.NOGKN ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File renamed C:\Users\Admin\Pictures\CopyUnregister.tif => C:\Users\Admin\Pictures\CopyUnregister.tif.NOGKN ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File renamed C:\Users\Admin\Pictures\MoveHide.raw => C:\Users\Admin\Pictures\MoveHide.raw.NOGKN ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File renamed C:\Users\Admin\Pictures\OutJoin.png => C:\Users\Admin\Pictures\OutJoin.png.NOGKN ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
Processes:
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\JAVA_01.MID ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\THMBNAIL.PNG ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN109.XML ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right_over.gif ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_OFF.GIF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105638.WMF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Seoul ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\BUTTON.GIF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ORIG98.POC ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\THMBNAIL.PNG ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\zh-TW.pak ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105846.WMF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESTS.ICO ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Palau ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Waveform.thmx ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\THMBNAIL.PNG ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14530_.GIF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304405.WMF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\icudtl.dat ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files\Java\jre7\bin\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\PREVIEW.GIF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24ImagesMask.bmp ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\SNEEZE.WAV ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Pushpin.thmx ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03011U.BMP ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7ES.LEX ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\readme.txt ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02426_.WMF ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exepid process 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1048 vssvc.exe Token: SeRestorePrivilege 1048 vssvc.exe Token: SeAuditPrivilege 1048 vssvc.exe Token: SeIncreaseQuotaPrivilege 1728 WMIC.exe Token: SeSecurityPrivilege 1728 WMIC.exe Token: SeTakeOwnershipPrivilege 1728 WMIC.exe Token: SeLoadDriverPrivilege 1728 WMIC.exe Token: SeSystemProfilePrivilege 1728 WMIC.exe Token: SeSystemtimePrivilege 1728 WMIC.exe Token: SeProfSingleProcessPrivilege 1728 WMIC.exe Token: SeIncBasePriorityPrivilege 1728 WMIC.exe Token: SeCreatePagefilePrivilege 1728 WMIC.exe Token: SeBackupPrivilege 1728 WMIC.exe Token: SeRestorePrivilege 1728 WMIC.exe Token: SeShutdownPrivilege 1728 WMIC.exe Token: SeDebugPrivilege 1728 WMIC.exe Token: SeSystemEnvironmentPrivilege 1728 WMIC.exe Token: SeRemoteShutdownPrivilege 1728 WMIC.exe Token: SeUndockPrivilege 1728 WMIC.exe Token: SeManageVolumePrivilege 1728 WMIC.exe Token: 33 1728 WMIC.exe Token: 34 1728 WMIC.exe Token: 35 1728 WMIC.exe Token: SeIncreaseQuotaPrivilege 1728 WMIC.exe Token: SeSecurityPrivilege 1728 WMIC.exe Token: SeTakeOwnershipPrivilege 1728 WMIC.exe Token: SeLoadDriverPrivilege 1728 WMIC.exe Token: SeSystemProfilePrivilege 1728 WMIC.exe Token: SeSystemtimePrivilege 1728 WMIC.exe Token: SeProfSingleProcessPrivilege 1728 WMIC.exe Token: SeIncBasePriorityPrivilege 1728 WMIC.exe Token: SeCreatePagefilePrivilege 1728 WMIC.exe Token: SeBackupPrivilege 1728 WMIC.exe Token: SeRestorePrivilege 1728 WMIC.exe Token: SeShutdownPrivilege 1728 WMIC.exe Token: SeDebugPrivilege 1728 WMIC.exe Token: SeSystemEnvironmentPrivilege 1728 WMIC.exe Token: SeRemoteShutdownPrivilege 1728 WMIC.exe Token: SeUndockPrivilege 1728 WMIC.exe Token: SeManageVolumePrivilege 1728 WMIC.exe Token: 33 1728 WMIC.exe Token: 34 1728 WMIC.exe Token: 35 1728 WMIC.exe Token: SeIncreaseQuotaPrivilege 1952 WMIC.exe Token: SeSecurityPrivilege 1952 WMIC.exe Token: SeTakeOwnershipPrivilege 1952 WMIC.exe Token: SeLoadDriverPrivilege 1952 WMIC.exe Token: SeSystemProfilePrivilege 1952 WMIC.exe Token: SeSystemtimePrivilege 1952 WMIC.exe Token: SeProfSingleProcessPrivilege 1952 WMIC.exe Token: SeIncBasePriorityPrivilege 1952 WMIC.exe Token: SeCreatePagefilePrivilege 1952 WMIC.exe Token: SeBackupPrivilege 1952 WMIC.exe Token: SeRestorePrivilege 1952 WMIC.exe Token: SeShutdownPrivilege 1952 WMIC.exe Token: SeDebugPrivilege 1952 WMIC.exe Token: SeSystemEnvironmentPrivilege 1952 WMIC.exe Token: SeRemoteShutdownPrivilege 1952 WMIC.exe Token: SeUndockPrivilege 1952 WMIC.exe Token: SeManageVolumePrivilege 1952 WMIC.exe Token: 33 1952 WMIC.exe Token: 34 1952 WMIC.exe Token: 35 1952 WMIC.exe Token: SeIncreaseQuotaPrivilege 1952 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1640 wrote to memory of 1864 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1864 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1864 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1864 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1864 wrote to memory of 1728 1864 cmd.exe WMIC.exe PID 1864 wrote to memory of 1728 1864 cmd.exe WMIC.exe PID 1864 wrote to memory of 1728 1864 cmd.exe WMIC.exe PID 1640 wrote to memory of 1940 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1940 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1940 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1940 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1940 wrote to memory of 1952 1940 cmd.exe WMIC.exe PID 1940 wrote to memory of 1952 1940 cmd.exe WMIC.exe PID 1940 wrote to memory of 1952 1940 cmd.exe WMIC.exe PID 1640 wrote to memory of 1708 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1708 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1708 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1708 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1708 wrote to memory of 1648 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 1648 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 1648 1708 cmd.exe WMIC.exe PID 1640 wrote to memory of 1616 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1616 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1616 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1616 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1616 wrote to memory of 2020 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 2020 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 2020 1616 cmd.exe WMIC.exe PID 1640 wrote to memory of 2036 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 2036 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 2036 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 2036 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 2036 wrote to memory of 1052 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 1052 2036 cmd.exe WMIC.exe PID 2036 wrote to memory of 1052 2036 cmd.exe WMIC.exe PID 1640 wrote to memory of 828 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 828 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 828 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 828 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 828 wrote to memory of 1600 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1600 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1600 828 cmd.exe WMIC.exe PID 1640 wrote to memory of 1400 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1400 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1400 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1400 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1400 wrote to memory of 1484 1400 cmd.exe WMIC.exe PID 1400 wrote to memory of 1484 1400 cmd.exe WMIC.exe PID 1400 wrote to memory of 1484 1400 cmd.exe WMIC.exe PID 1640 wrote to memory of 1524 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1524 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1524 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1524 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1524 wrote to memory of 1384 1524 cmd.exe WMIC.exe PID 1524 wrote to memory of 1384 1524 cmd.exe WMIC.exe PID 1524 wrote to memory of 1384 1524 cmd.exe WMIC.exe PID 1640 wrote to memory of 1916 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1916 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1916 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1640 wrote to memory of 1916 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe PID 1916 wrote to memory of 1736 1916 cmd.exe WMIC.exe PID 1916 wrote to memory of 1736 1916 cmd.exe WMIC.exe PID 1916 wrote to memory of 1736 1916 cmd.exe WMIC.exe PID 1640 wrote to memory of 1900 1640 ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\ac07fd904aaf9359967685d75918dcc6dbf9b78296e70fee8d6738e069845132.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete3⤵PID:1648
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete3⤵PID:2020
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete3⤵PID:1052
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete3⤵PID:1600
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete3⤵PID:1484
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete3⤵PID:1384
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete3⤵PID:1736
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete2⤵PID:1900
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete3⤵PID:1940
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete2⤵PID:1776
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete3⤵PID:1700
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048