Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 08:25
Static task
static1
Behavioral task
behavioral1
Sample
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe
-
Size
194KB
-
MD5
783d5a6f010336bf47803a5570fd0997
-
SHA1
e12cd3ebc23579f43ba7ec0cf07b29c79dc7dbe6
-
SHA256
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c
-
SHA512
5ed5ee8e23c0a95687172d8f8f39ac326f2ab5dd0c77b37fab281a2519cc07aa947db2ded9d4dea2e24e70f82cb932f350e7be9c56d9dbd96d1b5c64b5c039d0
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\SkipSplit.tiff 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File renamed C:\Users\Admin\Pictures\SkipSplit.tiff => C:\Users\Admin\Pictures\SkipSplit.tiff.ZSSCJ 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File renamed C:\Users\Admin\Pictures\CheckpointPush.crw => C:\Users\Admin\Pictures\CheckpointPush.crw.ZSSCJ 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\PublishApprove.tiff 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File renamed C:\Users\Admin\Pictures\PublishApprove.tiff => C:\Users\Admin\Pictures\PublishApprove.tiff.ZSSCJ 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File renamed C:\Users\Admin\Pictures\SkipDismount.crw => C:\Users\Admin\Pictures\SkipDismount.crw.ZSSCJ 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\gu\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\S_IlluNoSearchResults_180x160.svg 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\PYCC.pf 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\de-de\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-phn.xrm-ms 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\bn.pak 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\it-it\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\te.pak 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_zh_4.4.0.v20140623020002.jar 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\am\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\config.ini 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\bg_pattern_RHP.png 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\main-selector.css 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\root\ui-strings.js 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\3RDPARTY 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reminders_18.svg 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\AdobePiStd.otf 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_tr_135x40.svg 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\root\readme.txt 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeShellExperienceHost.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exepid process 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3464 vssvc.exe Token: SeRestorePrivilege 3464 vssvc.exe Token: SeAuditPrivilege 3464 vssvc.exe Token: SeIncreaseQuotaPrivilege 3440 WMIC.exe Token: SeSecurityPrivilege 3440 WMIC.exe Token: SeTakeOwnershipPrivilege 3440 WMIC.exe Token: SeLoadDriverPrivilege 3440 WMIC.exe Token: SeSystemProfilePrivilege 3440 WMIC.exe Token: SeSystemtimePrivilege 3440 WMIC.exe Token: SeProfSingleProcessPrivilege 3440 WMIC.exe Token: SeIncBasePriorityPrivilege 3440 WMIC.exe Token: SeCreatePagefilePrivilege 3440 WMIC.exe Token: SeBackupPrivilege 3440 WMIC.exe Token: SeRestorePrivilege 3440 WMIC.exe Token: SeShutdownPrivilege 3440 WMIC.exe Token: SeDebugPrivilege 3440 WMIC.exe Token: SeSystemEnvironmentPrivilege 3440 WMIC.exe Token: SeRemoteShutdownPrivilege 3440 WMIC.exe Token: SeUndockPrivilege 3440 WMIC.exe Token: SeManageVolumePrivilege 3440 WMIC.exe Token: 33 3440 WMIC.exe Token: 34 3440 WMIC.exe Token: 35 3440 WMIC.exe Token: 36 3440 WMIC.exe Token: SeIncreaseQuotaPrivilege 3440 WMIC.exe Token: SeSecurityPrivilege 3440 WMIC.exe Token: SeTakeOwnershipPrivilege 3440 WMIC.exe Token: SeLoadDriverPrivilege 3440 WMIC.exe Token: SeSystemProfilePrivilege 3440 WMIC.exe Token: SeSystemtimePrivilege 3440 WMIC.exe Token: SeProfSingleProcessPrivilege 3440 WMIC.exe Token: SeIncBasePriorityPrivilege 3440 WMIC.exe Token: SeCreatePagefilePrivilege 3440 WMIC.exe Token: SeBackupPrivilege 3440 WMIC.exe Token: SeRestorePrivilege 3440 WMIC.exe Token: SeShutdownPrivilege 3440 WMIC.exe Token: SeDebugPrivilege 3440 WMIC.exe Token: SeSystemEnvironmentPrivilege 3440 WMIC.exe Token: SeRemoteShutdownPrivilege 3440 WMIC.exe Token: SeUndockPrivilege 3440 WMIC.exe Token: SeManageVolumePrivilege 3440 WMIC.exe Token: 33 3440 WMIC.exe Token: 34 3440 WMIC.exe Token: 35 3440 WMIC.exe Token: 36 3440 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 2344 ShellExperienceHost.exe 2344 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.execmd.exedescription pid process target process PID 2388 wrote to memory of 3364 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe cmd.exe PID 2388 wrote to memory of 3364 2388 4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe cmd.exe PID 3364 wrote to memory of 3440 3364 cmd.exe WMIC.exe PID 3364 wrote to memory of 3440 3364 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\4d8e709832dc3b6cc9283dc2c79eac0d9a4092b1a3b180d7cc7ec6902b7a128c.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2388-115-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/3364-116-0x0000000000000000-mapping.dmp
-
memory/3440-117-0x0000000000000000-mapping.dmp
-
memory/3692-118-0x000001D2A1DC0000-0x000001D2A1DD0000-memory.dmpFilesize
64KB
-
memory/3692-119-0x000001D2A2560000-0x000001D2A2570000-memory.dmpFilesize
64KB
-
memory/3692-120-0x000001D2A4C00000-0x000001D2A4C01000-memory.dmpFilesize
4KB