Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 08:23
Static task
static1
Behavioral task
behavioral1
Sample
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe
Resource
win10v20210408
General
-
Target
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe
-
Size
195KB
-
MD5
9656b98b10d645f1850030f461acdf7b
-
SHA1
f2253855fa2d400c92f819c6ffec73281ec7232f
-
SHA256
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e
-
SHA512
17016e6d348761865c2c5fa82b94c94604cd819dc4ce0dad5ba2800e16d070eeb7ba261a68d37d4530adacdb955e0bfac42019ac432b1a22b60488f6387a1021
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\UnlockSet.xps 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Google\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Google\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Internet Explorer\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Microsoft Games\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\MSBuild\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Reference Assemblies\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\MSBuild\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DisablePublish.edrwx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Mozilla Firefox\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Common Files\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\ExpandUnblock.ico 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\License.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\ExitEdit.pcx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\SyncStart.png 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Java\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Adobe\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\7-Zip\Lang\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\EditUninstall.ram 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\ImportHide.dot 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files\Microsoft Office\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Microsoft Sync Framework\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\descript.ion 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\CompressEnable.docx 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\SelectExport.vstm 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\RestartLimit.mpe 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\UndoSync.tif 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exepid process 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1784 vssvc.exe Token: SeRestorePrivilege 1784 vssvc.exe Token: SeAuditPrivilege 1784 vssvc.exe Token: SeIncreaseQuotaPrivilege 436 WMIC.exe Token: SeSecurityPrivilege 436 WMIC.exe Token: SeTakeOwnershipPrivilege 436 WMIC.exe Token: SeLoadDriverPrivilege 436 WMIC.exe Token: SeSystemProfilePrivilege 436 WMIC.exe Token: SeSystemtimePrivilege 436 WMIC.exe Token: SeProfSingleProcessPrivilege 436 WMIC.exe Token: SeIncBasePriorityPrivilege 436 WMIC.exe Token: SeCreatePagefilePrivilege 436 WMIC.exe Token: SeBackupPrivilege 436 WMIC.exe Token: SeRestorePrivilege 436 WMIC.exe Token: SeShutdownPrivilege 436 WMIC.exe Token: SeDebugPrivilege 436 WMIC.exe Token: SeSystemEnvironmentPrivilege 436 WMIC.exe Token: SeRemoteShutdownPrivilege 436 WMIC.exe Token: SeUndockPrivilege 436 WMIC.exe Token: SeManageVolumePrivilege 436 WMIC.exe Token: 33 436 WMIC.exe Token: 34 436 WMIC.exe Token: 35 436 WMIC.exe Token: SeIncreaseQuotaPrivilege 436 WMIC.exe Token: SeSecurityPrivilege 436 WMIC.exe Token: SeTakeOwnershipPrivilege 436 WMIC.exe Token: SeLoadDriverPrivilege 436 WMIC.exe Token: SeSystemProfilePrivilege 436 WMIC.exe Token: SeSystemtimePrivilege 436 WMIC.exe Token: SeProfSingleProcessPrivilege 436 WMIC.exe Token: SeIncBasePriorityPrivilege 436 WMIC.exe Token: SeCreatePagefilePrivilege 436 WMIC.exe Token: SeBackupPrivilege 436 WMIC.exe Token: SeRestorePrivilege 436 WMIC.exe Token: SeShutdownPrivilege 436 WMIC.exe Token: SeDebugPrivilege 436 WMIC.exe Token: SeSystemEnvironmentPrivilege 436 WMIC.exe Token: SeRemoteShutdownPrivilege 436 WMIC.exe Token: SeUndockPrivilege 436 WMIC.exe Token: SeManageVolumePrivilege 436 WMIC.exe Token: 33 436 WMIC.exe Token: 34 436 WMIC.exe Token: 35 436 WMIC.exe Token: SeIncreaseQuotaPrivilege 1836 WMIC.exe Token: SeSecurityPrivilege 1836 WMIC.exe Token: SeTakeOwnershipPrivilege 1836 WMIC.exe Token: SeLoadDriverPrivilege 1836 WMIC.exe Token: SeSystemProfilePrivilege 1836 WMIC.exe Token: SeSystemtimePrivilege 1836 WMIC.exe Token: SeProfSingleProcessPrivilege 1836 WMIC.exe Token: SeIncBasePriorityPrivilege 1836 WMIC.exe Token: SeCreatePagefilePrivilege 1836 WMIC.exe Token: SeBackupPrivilege 1836 WMIC.exe Token: SeRestorePrivilege 1836 WMIC.exe Token: SeShutdownPrivilege 1836 WMIC.exe Token: SeDebugPrivilege 1836 WMIC.exe Token: SeSystemEnvironmentPrivilege 1836 WMIC.exe Token: SeRemoteShutdownPrivilege 1836 WMIC.exe Token: SeUndockPrivilege 1836 WMIC.exe Token: SeManageVolumePrivilege 1836 WMIC.exe Token: 33 1836 WMIC.exe Token: 34 1836 WMIC.exe Token: 35 1836 WMIC.exe Token: SeIncreaseQuotaPrivilege 1836 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1128 wrote to memory of 576 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 576 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 576 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 576 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 576 wrote to memory of 436 576 cmd.exe WMIC.exe PID 576 wrote to memory of 436 576 cmd.exe WMIC.exe PID 576 wrote to memory of 436 576 cmd.exe WMIC.exe PID 1128 wrote to memory of 1744 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1744 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1744 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1744 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1744 wrote to memory of 1836 1744 cmd.exe WMIC.exe PID 1744 wrote to memory of 1836 1744 cmd.exe WMIC.exe PID 1744 wrote to memory of 1836 1744 cmd.exe WMIC.exe PID 1128 wrote to memory of 456 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 456 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 456 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 456 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 456 wrote to memory of 900 456 cmd.exe WMIC.exe PID 456 wrote to memory of 900 456 cmd.exe WMIC.exe PID 456 wrote to memory of 900 456 cmd.exe WMIC.exe PID 1128 wrote to memory of 1844 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1844 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1844 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1844 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1844 wrote to memory of 1248 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1248 1844 cmd.exe WMIC.exe PID 1844 wrote to memory of 1248 1844 cmd.exe WMIC.exe PID 1128 wrote to memory of 1472 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1472 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1472 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1472 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1472 wrote to memory of 1456 1472 cmd.exe WMIC.exe PID 1472 wrote to memory of 1456 1472 cmd.exe WMIC.exe PID 1472 wrote to memory of 1456 1472 cmd.exe WMIC.exe PID 1128 wrote to memory of 1616 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1616 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1616 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1616 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1616 wrote to memory of 1080 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1080 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1080 1616 cmd.exe WMIC.exe PID 1128 wrote to memory of 1728 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1728 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1728 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1728 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1728 wrote to memory of 1144 1728 cmd.exe WMIC.exe PID 1728 wrote to memory of 1144 1728 cmd.exe WMIC.exe PID 1728 wrote to memory of 1144 1728 cmd.exe WMIC.exe PID 1128 wrote to memory of 320 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 320 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 320 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 320 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 320 wrote to memory of 536 320 cmd.exe WMIC.exe PID 320 wrote to memory of 536 320 cmd.exe WMIC.exe PID 320 wrote to memory of 536 320 cmd.exe WMIC.exe PID 1128 wrote to memory of 1764 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1764 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1764 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1128 wrote to memory of 1764 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe PID 1764 wrote to memory of 1356 1764 cmd.exe WMIC.exe PID 1764 wrote to memory of 1356 1764 cmd.exe WMIC.exe PID 1764 wrote to memory of 1356 1764 cmd.exe WMIC.exe PID 1128 wrote to memory of 364 1128 3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\3c014b34aa1179e1073766f8811577fece916cc14cafb6d6697ecad0466ef82e.bin.sample.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:436 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵PID:900
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵PID:1248
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵PID:1456
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵PID:1080
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵PID:1144
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵PID:536
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵PID:1356
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵PID:364
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵PID:820
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵PID:1644
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵PID:1548
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵PID:1948
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵PID:1556
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784