Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 08:15
Static task
static1
Behavioral task
behavioral1
Sample
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe
Resource
win10v20210408
General
-
Target
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe
-
Size
191KB
-
MD5
435b7f9a16f6846fd263e6641df6f496
-
SHA1
fc45d2718f67ea9b59c7fc30c3d585049f884c12
-
SHA256
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70
-
SHA512
5fa0c155a512ace1f78db1c0af612f06781b4e7e42e6ebb24d074ad1de9d73dbe2b2d4cf4665740241e41fecb22f2f8eeeb74d027a05a60f474f4807fe2160c7
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\StopMount.png => C:\Users\Admin\Pictures\StopMount.png.MRBNY be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File renamed C:\Users\Admin\Pictures\TestSkip.raw => C:\Users\Admin\Pictures\TestSkip.raw.MRBNY be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File renamed C:\Users\Admin\Pictures\UninstallBlock.tif => C:\Users\Admin\Pictures\UninstallBlock.tif.MRBNY be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectSave.raw => C:\Users\Admin\Pictures\UnprotectSave.raw.MRBNY be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompleteCompress.crw => C:\Users\Admin\Pictures\CompleteCompress.crw.MRBNY be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File renamed C:\Users\Admin\Pictures\FormatPush.png => C:\Users\Admin\Pictures\FormatPush.png.MRBNY be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\MountNew.tiff be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File renamed C:\Users\Admin\Pictures\MountNew.tiff => C:\Users\Admin\Pictures\MountNew.tiff.MRBNY be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Searches\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SlateBlue.css be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVTEL.DIC be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00416_.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0305493.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.PL.XML be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\PublishPush.clr be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\readme.txt be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE04050_.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ACTIVITL.ICO be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALNDR98.POC be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14844_.GIF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBCN6.CHM be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ROAD_01.MID be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\PREVIEW.GIF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\readme.txt be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FLAP.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\readme.txt be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ORG97R.SAM be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SPRNG_01.MID be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14830_.GIF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File created C:\Program Files\Java\jre7\lib\ext\readme.txt be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\readme.txt be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS11.POC be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238333.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Median.eftx be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\readme.txt be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\sRGB.pf be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\readme.txt be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\WT61FR.LEX be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02009_.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00728_.WMF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\ICE.INF be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exepid process 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1768 vssvc.exe Token: SeRestorePrivilege 1768 vssvc.exe Token: SeAuditPrivilege 1768 vssvc.exe Token: SeIncreaseQuotaPrivilege 1184 WMIC.exe Token: SeSecurityPrivilege 1184 WMIC.exe Token: SeTakeOwnershipPrivilege 1184 WMIC.exe Token: SeLoadDriverPrivilege 1184 WMIC.exe Token: SeSystemProfilePrivilege 1184 WMIC.exe Token: SeSystemtimePrivilege 1184 WMIC.exe Token: SeProfSingleProcessPrivilege 1184 WMIC.exe Token: SeIncBasePriorityPrivilege 1184 WMIC.exe Token: SeCreatePagefilePrivilege 1184 WMIC.exe Token: SeBackupPrivilege 1184 WMIC.exe Token: SeRestorePrivilege 1184 WMIC.exe Token: SeShutdownPrivilege 1184 WMIC.exe Token: SeDebugPrivilege 1184 WMIC.exe Token: SeSystemEnvironmentPrivilege 1184 WMIC.exe Token: SeRemoteShutdownPrivilege 1184 WMIC.exe Token: SeUndockPrivilege 1184 WMIC.exe Token: SeManageVolumePrivilege 1184 WMIC.exe Token: 33 1184 WMIC.exe Token: 34 1184 WMIC.exe Token: 35 1184 WMIC.exe Token: SeIncreaseQuotaPrivilege 1184 WMIC.exe Token: SeSecurityPrivilege 1184 WMIC.exe Token: SeTakeOwnershipPrivilege 1184 WMIC.exe Token: SeLoadDriverPrivilege 1184 WMIC.exe Token: SeSystemProfilePrivilege 1184 WMIC.exe Token: SeSystemtimePrivilege 1184 WMIC.exe Token: SeProfSingleProcessPrivilege 1184 WMIC.exe Token: SeIncBasePriorityPrivilege 1184 WMIC.exe Token: SeCreatePagefilePrivilege 1184 WMIC.exe Token: SeBackupPrivilege 1184 WMIC.exe Token: SeRestorePrivilege 1184 WMIC.exe Token: SeShutdownPrivilege 1184 WMIC.exe Token: SeDebugPrivilege 1184 WMIC.exe Token: SeSystemEnvironmentPrivilege 1184 WMIC.exe Token: SeRemoteShutdownPrivilege 1184 WMIC.exe Token: SeUndockPrivilege 1184 WMIC.exe Token: SeManageVolumePrivilege 1184 WMIC.exe Token: 33 1184 WMIC.exe Token: 34 1184 WMIC.exe Token: 35 1184 WMIC.exe Token: SeIncreaseQuotaPrivilege 792 WMIC.exe Token: SeSecurityPrivilege 792 WMIC.exe Token: SeTakeOwnershipPrivilege 792 WMIC.exe Token: SeLoadDriverPrivilege 792 WMIC.exe Token: SeSystemProfilePrivilege 792 WMIC.exe Token: SeSystemtimePrivilege 792 WMIC.exe Token: SeProfSingleProcessPrivilege 792 WMIC.exe Token: SeIncBasePriorityPrivilege 792 WMIC.exe Token: SeCreatePagefilePrivilege 792 WMIC.exe Token: SeBackupPrivilege 792 WMIC.exe Token: SeRestorePrivilege 792 WMIC.exe Token: SeShutdownPrivilege 792 WMIC.exe Token: SeDebugPrivilege 792 WMIC.exe Token: SeSystemEnvironmentPrivilege 792 WMIC.exe Token: SeRemoteShutdownPrivilege 792 WMIC.exe Token: SeUndockPrivilege 792 WMIC.exe Token: SeManageVolumePrivilege 792 WMIC.exe Token: 33 792 WMIC.exe Token: 34 792 WMIC.exe Token: 35 792 WMIC.exe Token: SeIncreaseQuotaPrivilege 792 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 840 wrote to memory of 332 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 332 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 332 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 332 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 332 wrote to memory of 1184 332 cmd.exe WMIC.exe PID 332 wrote to memory of 1184 332 cmd.exe WMIC.exe PID 332 wrote to memory of 1184 332 cmd.exe WMIC.exe PID 840 wrote to memory of 1460 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1460 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1460 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1460 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 1460 wrote to memory of 792 1460 cmd.exe WMIC.exe PID 1460 wrote to memory of 792 1460 cmd.exe WMIC.exe PID 1460 wrote to memory of 792 1460 cmd.exe WMIC.exe PID 840 wrote to memory of 1472 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1472 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1472 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1472 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 1472 wrote to memory of 432 1472 cmd.exe WMIC.exe PID 1472 wrote to memory of 432 1472 cmd.exe WMIC.exe PID 1472 wrote to memory of 432 1472 cmd.exe WMIC.exe PID 840 wrote to memory of 1144 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1144 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1144 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1144 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1076 1144 cmd.exe WMIC.exe PID 1144 wrote to memory of 1076 1144 cmd.exe WMIC.exe PID 1144 wrote to memory of 1076 1144 cmd.exe WMIC.exe PID 840 wrote to memory of 1432 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1432 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1432 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1432 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 1432 wrote to memory of 1592 1432 cmd.exe WMIC.exe PID 1432 wrote to memory of 1592 1432 cmd.exe WMIC.exe PID 1432 wrote to memory of 1592 1432 cmd.exe WMIC.exe PID 840 wrote to memory of 456 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 456 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 456 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 456 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 456 wrote to memory of 1792 456 cmd.exe WMIC.exe PID 456 wrote to memory of 1792 456 cmd.exe WMIC.exe PID 456 wrote to memory of 1792 456 cmd.exe WMIC.exe PID 840 wrote to memory of 1720 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1720 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1720 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1720 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 1720 wrote to memory of 1736 1720 cmd.exe WMIC.exe PID 1720 wrote to memory of 1736 1720 cmd.exe WMIC.exe PID 1720 wrote to memory of 1736 1720 cmd.exe WMIC.exe PID 840 wrote to memory of 1188 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1188 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1188 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 1188 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 1188 wrote to memory of 1260 1188 cmd.exe WMIC.exe PID 1188 wrote to memory of 1260 1188 cmd.exe WMIC.exe PID 1188 wrote to memory of 1260 1188 cmd.exe WMIC.exe PID 840 wrote to memory of 616 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 616 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 616 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 840 wrote to memory of 616 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe PID 616 wrote to memory of 1836 616 cmd.exe WMIC.exe PID 616 wrote to memory of 1836 616 cmd.exe WMIC.exe PID 616 wrote to memory of 1836 616 cmd.exe WMIC.exe PID 840 wrote to memory of 1120 840 be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\be277aea966fd23c28bf2fcbe04959f19fd008dfac3dd0508f747f177f6bed70.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:792 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵PID:432
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵PID:1076
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵PID:1592
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵PID:1792
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵PID:1736
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵PID:1260
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵PID:1836
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵PID:1120
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵PID:1828
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵PID:1956
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵PID:1512
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵PID:556
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵PID:1584
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768