Analysis
-
max time kernel
160s -
max time network
162s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 08:02
Static task
static1
Behavioral task
behavioral1
Sample
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe
Resource
win10v20210408
General
-
Target
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe
-
Size
196KB
-
MD5
75a4117876741cc839d083cbeffd9e88
-
SHA1
044f4d9fbe5f7fcaa350e6ae900f240bafd07c31
-
SHA256
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b
-
SHA512
77b1521650276dc61b47eaffd28ab7b03f61ee6842a7e296ceca8005966e2553d75942f3529aa6161850971629ac5fb4f2140328b6d550d5dd7f70a7a38b79be
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 16 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\FormatShow.tif => C:\Users\Admin\Pictures\FormatShow.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\RevokeInitialize.png => C:\Users\Admin\Pictures\RevokeInitialize.png.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompleteSelect.png => C:\Users\Admin\Pictures\CompleteSelect.png.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\RevokeMerge.tif => C:\Users\Admin\Pictures\RevokeMerge.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnlockEdit.crw => C:\Users\Admin\Pictures\UnlockEdit.crw.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\UseUndo.png => C:\Users\Admin\Pictures\UseUndo.png.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\ConfirmRestore.tif => C:\Users\Admin\Pictures\ConfirmRestore.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\StopBackup.png => C:\Users\Admin\Pictures\StopBackup.png.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\UseLimit.tiff 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\UseLimit.tiff => C:\Users\Admin\Pictures\UseLimit.tiff.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\ImportUninstall.tiff => C:\Users\Admin\Pictures\ImportUninstall.tiff.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\MoveResolve.raw => C:\Users\Admin\Pictures\MoveResolve.raw.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\PopUnregister.tif => C:\Users\Admin\Pictures\PopUnregister.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\RevokeTest.tif => C:\Users\Admin\Pictures\RevokeTest.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\SubmitUndo.tif => C:\Users\Admin\Pictures\SubmitUndo.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\ImportUninstall.tiff 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Drops desktop.ini file(s) 29 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\java.policy 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\pa\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\Internet Explorer\images\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\VERSION.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\Common Files\Services\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-180.png 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.htm 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_200_percent.pak 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-phn.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\tr.pak 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\nl.pak 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exepid process 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3652 vssvc.exe Token: SeRestorePrivilege 3652 vssvc.exe Token: SeAuditPrivilege 3652 vssvc.exe Token: SeIncreaseQuotaPrivilege 3580 WMIC.exe Token: SeSecurityPrivilege 3580 WMIC.exe Token: SeTakeOwnershipPrivilege 3580 WMIC.exe Token: SeLoadDriverPrivilege 3580 WMIC.exe Token: SeSystemProfilePrivilege 3580 WMIC.exe Token: SeSystemtimePrivilege 3580 WMIC.exe Token: SeProfSingleProcessPrivilege 3580 WMIC.exe Token: SeIncBasePriorityPrivilege 3580 WMIC.exe Token: SeCreatePagefilePrivilege 3580 WMIC.exe Token: SeBackupPrivilege 3580 WMIC.exe Token: SeRestorePrivilege 3580 WMIC.exe Token: SeShutdownPrivilege 3580 WMIC.exe Token: SeDebugPrivilege 3580 WMIC.exe Token: SeSystemEnvironmentPrivilege 3580 WMIC.exe Token: SeRemoteShutdownPrivilege 3580 WMIC.exe Token: SeUndockPrivilege 3580 WMIC.exe Token: SeManageVolumePrivilege 3580 WMIC.exe Token: 33 3580 WMIC.exe Token: 34 3580 WMIC.exe Token: 35 3580 WMIC.exe Token: 36 3580 WMIC.exe Token: SeIncreaseQuotaPrivilege 3580 WMIC.exe Token: SeSecurityPrivilege 3580 WMIC.exe Token: SeTakeOwnershipPrivilege 3580 WMIC.exe Token: SeLoadDriverPrivilege 3580 WMIC.exe Token: SeSystemProfilePrivilege 3580 WMIC.exe Token: SeSystemtimePrivilege 3580 WMIC.exe Token: SeProfSingleProcessPrivilege 3580 WMIC.exe Token: SeIncBasePriorityPrivilege 3580 WMIC.exe Token: SeCreatePagefilePrivilege 3580 WMIC.exe Token: SeBackupPrivilege 3580 WMIC.exe Token: SeRestorePrivilege 3580 WMIC.exe Token: SeShutdownPrivilege 3580 WMIC.exe Token: SeDebugPrivilege 3580 WMIC.exe Token: SeSystemEnvironmentPrivilege 3580 WMIC.exe Token: SeRemoteShutdownPrivilege 3580 WMIC.exe Token: SeUndockPrivilege 3580 WMIC.exe Token: SeManageVolumePrivilege 3580 WMIC.exe Token: 33 3580 WMIC.exe Token: 34 3580 WMIC.exe Token: 35 3580 WMIC.exe Token: 36 3580 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.execmd.exedescription pid process target process PID 580 wrote to memory of 4068 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 580 wrote to memory of 4068 580 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 4068 wrote to memory of 3580 4068 cmd.exe WMIC.exe PID 4068 wrote to memory of 3580 4068 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652