Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 07:53
Static task
static1
Behavioral task
behavioral1
Sample
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe
Resource
win10v20210408
General
-
Target
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe
-
Size
196KB
-
MD5
21cebf7aefdae41e3c0c89a3a6f904c4
-
SHA1
866419baad25a08b12cefbe6d19681bae7b692a3
-
SHA256
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196
-
SHA512
b4eec6daf509a3dd5518f09eeceff016ee10c48b84fa9ea35dd13f35de71ee7356029b872b79a4cfd74b42b437d0c044fceda4c7c07ecaf1f59bea31a7477446
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\JoinOut.tif => C:\Users\Admin\Pictures\JoinOut.tif.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\MergeUnregister.tiff => C:\Users\Admin\Pictures\MergeUnregister.tiff.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResolveRegister.tif => C:\Users\Admin\Pictures\ResolveRegister.tif.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\BlockConvert.png => C:\Users\Admin\Pictures\BlockConvert.png.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\CompleteDisconnect.tiff 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompleteDisconnect.tiff => C:\Users\Admin\Pictures\CompleteDisconnect.tiff.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\SplitRedo.png => C:\Users\Admin\Pictures\SplitRedo.png.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\StopEdit.raw => C:\Users\Admin\Pictures\StopEdit.raw.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\CopyReset.raw => C:\Users\Admin\Pictures\CopyReset.raw.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\MergeUnregister.tiff 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File renamed C:\Users\Admin\Pictures\RestartEdit.raw => C:\Users\Admin\Pictures\RestartEdit.raw.MPSJS 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nl-nl\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pt-PT.pak 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Garden.htm 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforcomments_18.svg 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN089.XML 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\AddressBook2x.png 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h2x.png 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBLR6.CHM 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\README_en_US.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ar-ae\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\rt.jar 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\he-il\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\readme.txt 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ro-ro\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview.png 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-cn\ui-strings.js 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exepid process 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1084 vssvc.exe Token: SeRestorePrivilege 1084 vssvc.exe Token: SeAuditPrivilege 1084 vssvc.exe Token: SeIncreaseQuotaPrivilege 1720 WMIC.exe Token: SeSecurityPrivilege 1720 WMIC.exe Token: SeTakeOwnershipPrivilege 1720 WMIC.exe Token: SeLoadDriverPrivilege 1720 WMIC.exe Token: SeSystemProfilePrivilege 1720 WMIC.exe Token: SeSystemtimePrivilege 1720 WMIC.exe Token: SeProfSingleProcessPrivilege 1720 WMIC.exe Token: SeIncBasePriorityPrivilege 1720 WMIC.exe Token: SeCreatePagefilePrivilege 1720 WMIC.exe Token: SeBackupPrivilege 1720 WMIC.exe Token: SeRestorePrivilege 1720 WMIC.exe Token: SeShutdownPrivilege 1720 WMIC.exe Token: SeDebugPrivilege 1720 WMIC.exe Token: SeSystemEnvironmentPrivilege 1720 WMIC.exe Token: SeRemoteShutdownPrivilege 1720 WMIC.exe Token: SeUndockPrivilege 1720 WMIC.exe Token: SeManageVolumePrivilege 1720 WMIC.exe Token: 33 1720 WMIC.exe Token: 34 1720 WMIC.exe Token: 35 1720 WMIC.exe Token: 36 1720 WMIC.exe Token: SeIncreaseQuotaPrivilege 1720 WMIC.exe Token: SeSecurityPrivilege 1720 WMIC.exe Token: SeTakeOwnershipPrivilege 1720 WMIC.exe Token: SeLoadDriverPrivilege 1720 WMIC.exe Token: SeSystemProfilePrivilege 1720 WMIC.exe Token: SeSystemtimePrivilege 1720 WMIC.exe Token: SeProfSingleProcessPrivilege 1720 WMIC.exe Token: SeIncBasePriorityPrivilege 1720 WMIC.exe Token: SeCreatePagefilePrivilege 1720 WMIC.exe Token: SeBackupPrivilege 1720 WMIC.exe Token: SeRestorePrivilege 1720 WMIC.exe Token: SeShutdownPrivilege 1720 WMIC.exe Token: SeDebugPrivilege 1720 WMIC.exe Token: SeSystemEnvironmentPrivilege 1720 WMIC.exe Token: SeRemoteShutdownPrivilege 1720 WMIC.exe Token: SeUndockPrivilege 1720 WMIC.exe Token: SeManageVolumePrivilege 1720 WMIC.exe Token: 33 1720 WMIC.exe Token: 34 1720 WMIC.exe Token: 35 1720 WMIC.exe Token: 36 1720 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.execmd.exedescription pid process target process PID 808 wrote to memory of 1472 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe cmd.exe PID 808 wrote to memory of 1472 808 2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe cmd.exe PID 1472 wrote to memory of 1720 1472 cmd.exe WMIC.exe PID 1472 wrote to memory of 1720 1472 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\2412b5ee3bf9de72b0e98999857d0152dbc6d0e8204d907f874ce71bcef70196.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:60
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
PID:284