Analysis
-
max time kernel
141s -
max time network
135s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 08:24
Static task
static1
Behavioral task
behavioral1
Sample
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe
Resource
win10v20210408
General
-
Target
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe
-
Size
196KB
-
MD5
75a4117876741cc839d083cbeffd9e88
-
SHA1
044f4d9fbe5f7fcaa350e6ae900f240bafd07c31
-
SHA256
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b
-
SHA512
77b1521650276dc61b47eaffd28ab7b03f61ee6842a7e296ceca8005966e2553d75942f3529aa6161850971629ac5fb4f2140328b6d550d5dd7f70a7a38b79be
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\TraceCopy.png => C:\Users\Admin\Pictures\TraceCopy.png.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\WaitRedo.tif => C:\Users\Admin\Pictures\WaitRedo.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\CheckpointUnpublish.tif => C:\Users\Admin\Pictures\CheckpointUnpublish.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\InstallLock.crw => C:\Users\Admin\Pictures\InstallLock.crw.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\InvokeWrite.tif => C:\Users\Admin\Pictures\InvokeWrite.tif.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\SearchUndo.tiff 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File renamed C:\Users\Admin\Pictures\SearchUndo.tiff => C:\Users\Admin\Pictures\SearchUndo.tiff.KHNIJ 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exedescription ioc process File created C:\Program Files\Microsoft Games\Hearts\en-US\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183574.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-execution.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files (x86)\Google\Update\Install\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0185604.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5B.BDR 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-api.xml 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\PREVIEW.GIF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REPLTMPL.CFG 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASK.CFG 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01178_.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294991.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.DPV 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01039_.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadomd28.tlb 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19827_.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215710.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\TURABIAN.XSL 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ar.pak 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00046_.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10266_.GIF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR42F.GIF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\TAB_ON.GIF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Horizon.thmx 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_OFF.GIF 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\readme.txt 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\GRAY.pf 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Manila 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exepid process 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1536 vssvc.exe Token: SeRestorePrivilege 1536 vssvc.exe Token: SeAuditPrivilege 1536 vssvc.exe Token: SeIncreaseQuotaPrivilege 472 WMIC.exe Token: SeSecurityPrivilege 472 WMIC.exe Token: SeTakeOwnershipPrivilege 472 WMIC.exe Token: SeLoadDriverPrivilege 472 WMIC.exe Token: SeSystemProfilePrivilege 472 WMIC.exe Token: SeSystemtimePrivilege 472 WMIC.exe Token: SeProfSingleProcessPrivilege 472 WMIC.exe Token: SeIncBasePriorityPrivilege 472 WMIC.exe Token: SeCreatePagefilePrivilege 472 WMIC.exe Token: SeBackupPrivilege 472 WMIC.exe Token: SeRestorePrivilege 472 WMIC.exe Token: SeShutdownPrivilege 472 WMIC.exe Token: SeDebugPrivilege 472 WMIC.exe Token: SeSystemEnvironmentPrivilege 472 WMIC.exe Token: SeRemoteShutdownPrivilege 472 WMIC.exe Token: SeUndockPrivilege 472 WMIC.exe Token: SeManageVolumePrivilege 472 WMIC.exe Token: 33 472 WMIC.exe Token: 34 472 WMIC.exe Token: 35 472 WMIC.exe Token: SeIncreaseQuotaPrivilege 472 WMIC.exe Token: SeSecurityPrivilege 472 WMIC.exe Token: SeTakeOwnershipPrivilege 472 WMIC.exe Token: SeLoadDriverPrivilege 472 WMIC.exe Token: SeSystemProfilePrivilege 472 WMIC.exe Token: SeSystemtimePrivilege 472 WMIC.exe Token: SeProfSingleProcessPrivilege 472 WMIC.exe Token: SeIncBasePriorityPrivilege 472 WMIC.exe Token: SeCreatePagefilePrivilege 472 WMIC.exe Token: SeBackupPrivilege 472 WMIC.exe Token: SeRestorePrivilege 472 WMIC.exe Token: SeShutdownPrivilege 472 WMIC.exe Token: SeDebugPrivilege 472 WMIC.exe Token: SeSystemEnvironmentPrivilege 472 WMIC.exe Token: SeRemoteShutdownPrivilege 472 WMIC.exe Token: SeUndockPrivilege 472 WMIC.exe Token: SeManageVolumePrivilege 472 WMIC.exe Token: 33 472 WMIC.exe Token: 34 472 WMIC.exe Token: 35 472 WMIC.exe Token: SeIncreaseQuotaPrivilege 1812 WMIC.exe Token: SeSecurityPrivilege 1812 WMIC.exe Token: SeTakeOwnershipPrivilege 1812 WMIC.exe Token: SeLoadDriverPrivilege 1812 WMIC.exe Token: SeSystemProfilePrivilege 1812 WMIC.exe Token: SeSystemtimePrivilege 1812 WMIC.exe Token: SeProfSingleProcessPrivilege 1812 WMIC.exe Token: SeIncBasePriorityPrivilege 1812 WMIC.exe Token: SeCreatePagefilePrivilege 1812 WMIC.exe Token: SeBackupPrivilege 1812 WMIC.exe Token: SeRestorePrivilege 1812 WMIC.exe Token: SeShutdownPrivilege 1812 WMIC.exe Token: SeDebugPrivilege 1812 WMIC.exe Token: SeSystemEnvironmentPrivilege 1812 WMIC.exe Token: SeRemoteShutdownPrivilege 1812 WMIC.exe Token: SeUndockPrivilege 1812 WMIC.exe Token: SeManageVolumePrivilege 1812 WMIC.exe Token: 33 1812 WMIC.exe Token: 34 1812 WMIC.exe Token: 35 1812 WMIC.exe Token: SeIncreaseQuotaPrivilege 1812 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1144 wrote to memory of 2012 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 2012 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 2012 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 2012 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 2012 wrote to memory of 472 2012 cmd.exe WMIC.exe PID 2012 wrote to memory of 472 2012 cmd.exe WMIC.exe PID 2012 wrote to memory of 472 2012 cmd.exe WMIC.exe PID 1144 wrote to memory of 984 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 984 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 984 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 984 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 984 wrote to memory of 1812 984 cmd.exe WMIC.exe PID 984 wrote to memory of 1812 984 cmd.exe WMIC.exe PID 984 wrote to memory of 1812 984 cmd.exe WMIC.exe PID 1144 wrote to memory of 1624 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1624 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1624 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1624 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1624 wrote to memory of 1108 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 1108 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 1108 1624 cmd.exe WMIC.exe PID 1144 wrote to memory of 1748 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1748 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1748 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1748 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1748 wrote to memory of 1572 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1572 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1572 1748 cmd.exe WMIC.exe PID 1144 wrote to memory of 2024 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 2024 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 2024 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 2024 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 2024 wrote to memory of 2020 2024 cmd.exe WMIC.exe PID 2024 wrote to memory of 2020 2024 cmd.exe WMIC.exe PID 2024 wrote to memory of 2020 2024 cmd.exe WMIC.exe PID 1144 wrote to memory of 1824 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1824 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1824 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1824 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1824 wrote to memory of 1960 1824 cmd.exe WMIC.exe PID 1824 wrote to memory of 1960 1824 cmd.exe WMIC.exe PID 1824 wrote to memory of 1960 1824 cmd.exe WMIC.exe PID 1144 wrote to memory of 1304 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1304 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1304 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1304 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1172 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1172 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1172 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 1172 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1172 wrote to memory of 768 1172 cmd.exe WMIC.exe PID 1172 wrote to memory of 768 1172 cmd.exe WMIC.exe PID 1172 wrote to memory of 768 1172 cmd.exe WMIC.exe PID 1144 wrote to memory of 608 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 608 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 608 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 608 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 608 wrote to memory of 560 608 cmd.exe WMIC.exe PID 608 wrote to memory of 560 608 cmd.exe WMIC.exe PID 608 wrote to memory of 560 608 cmd.exe WMIC.exe PID 1144 wrote to memory of 868 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 868 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 868 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe PID 1144 wrote to memory of 868 1144 42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\42ebe9b09e9e2ee2d1c345632a571cbaf09fcad3be9662af661c2bce110cc09b.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:472 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵PID:1108
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵PID:1572
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵PID:2020
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵PID:1960
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵PID:1304
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵PID:1592
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵PID:768
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵PID:560
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵PID:868
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵PID:644
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵PID:1076
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵PID:1260
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵PID:1616
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵PID:1004
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536