Analysis
-
max time kernel
144s -
max time network
97s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 09:21
Static task
static1
Behavioral task
behavioral1
Sample
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe
Resource
win10v20210408
General
-
Target
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe
-
Size
185KB
-
MD5
304745b78d1caf12316eb73955eb175f
-
SHA1
20967bd64eabb8dddbaa711c85c7bd2f3146ee83
-
SHA256
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c
-
SHA512
96ba786d72822c771cf97912cc993c4e626104887d8f71d22b8b02b9f973c70b62258ac31a40baabbe6a662e67633cba8dd550ef91fa36b3696e35e715c4c024
Malware Config
Extracted
C:\R3ADM3.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\RepairWait.tif => C:\Users\Admin\Pictures\RepairWait.tif.PLYIR 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResumeOptimize.crw => C:\Users\Admin\Pictures\ResumeOptimize.crw.PLYIR 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File renamed C:\Users\Admin\Pictures\LimitDisable.raw => C:\Users\Admin\Pictures\LimitDisable.raw.PLYIR 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\LimitTest.tiff 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File renamed C:\Users\Admin\Pictures\LimitTest.tiff => C:\Users\Admin\Pictures\LimitTest.tiff.PLYIR 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
Processes:
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exedescription ioc process File opened for modification C:\Program Files\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\R3ADM3.txt 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\R3ADM3.txt 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00915_.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\STRTEDGE.INF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMIMES.CFG 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\R3ADM3.txt 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\SoftBlue.jpg 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\R3ADM3.txt 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPICCAP.DPV 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\CONCRETE.INF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212701.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL011.XML 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\R3ADM3.txt 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105238.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105502.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00943_.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Havana 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_pressed.gif 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Horizon.eftx 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\R3ADM3.txt 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09194_.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187839.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00256_.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng.hyp 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\Parity.fx 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Chagos 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTVIEW.JPG 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File created C:\Program Files\Java\jre7\lib\images\cursors\R3ADM3.txt 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPMS.ICO 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignright.gif 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exepid process 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1284 vssvc.exe Token: SeRestorePrivilege 1284 vssvc.exe Token: SeAuditPrivilege 1284 vssvc.exe Token: SeIncreaseQuotaPrivilege 604 WMIC.exe Token: SeSecurityPrivilege 604 WMIC.exe Token: SeTakeOwnershipPrivilege 604 WMIC.exe Token: SeLoadDriverPrivilege 604 WMIC.exe Token: SeSystemProfilePrivilege 604 WMIC.exe Token: SeSystemtimePrivilege 604 WMIC.exe Token: SeProfSingleProcessPrivilege 604 WMIC.exe Token: SeIncBasePriorityPrivilege 604 WMIC.exe Token: SeCreatePagefilePrivilege 604 WMIC.exe Token: SeBackupPrivilege 604 WMIC.exe Token: SeRestorePrivilege 604 WMIC.exe Token: SeShutdownPrivilege 604 WMIC.exe Token: SeDebugPrivilege 604 WMIC.exe Token: SeSystemEnvironmentPrivilege 604 WMIC.exe Token: SeRemoteShutdownPrivilege 604 WMIC.exe Token: SeUndockPrivilege 604 WMIC.exe Token: SeManageVolumePrivilege 604 WMIC.exe Token: 33 604 WMIC.exe Token: 34 604 WMIC.exe Token: 35 604 WMIC.exe Token: SeIncreaseQuotaPrivilege 604 WMIC.exe Token: SeSecurityPrivilege 604 WMIC.exe Token: SeTakeOwnershipPrivilege 604 WMIC.exe Token: SeLoadDriverPrivilege 604 WMIC.exe Token: SeSystemProfilePrivilege 604 WMIC.exe Token: SeSystemtimePrivilege 604 WMIC.exe Token: SeProfSingleProcessPrivilege 604 WMIC.exe Token: SeIncBasePriorityPrivilege 604 WMIC.exe Token: SeCreatePagefilePrivilege 604 WMIC.exe Token: SeBackupPrivilege 604 WMIC.exe Token: SeRestorePrivilege 604 WMIC.exe Token: SeShutdownPrivilege 604 WMIC.exe Token: SeDebugPrivilege 604 WMIC.exe Token: SeSystemEnvironmentPrivilege 604 WMIC.exe Token: SeRemoteShutdownPrivilege 604 WMIC.exe Token: SeUndockPrivilege 604 WMIC.exe Token: SeManageVolumePrivilege 604 WMIC.exe Token: 33 604 WMIC.exe Token: 34 604 WMIC.exe Token: 35 604 WMIC.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1304 wrote to memory of 604 1304 cmd.exe WMIC.exe PID 1304 wrote to memory of 604 1304 cmd.exe WMIC.exe PID 1304 wrote to memory of 604 1304 cmd.exe WMIC.exe PID 1996 wrote to memory of 520 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 520 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 520 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 520 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 520 wrote to memory of 564 520 cmd.exe WMIC.exe PID 520 wrote to memory of 564 520 cmd.exe WMIC.exe PID 520 wrote to memory of 564 520 cmd.exe WMIC.exe PID 1996 wrote to memory of 584 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 584 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 584 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 584 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 584 wrote to memory of 1408 584 cmd.exe WMIC.exe PID 584 wrote to memory of 1408 584 cmd.exe WMIC.exe PID 584 wrote to memory of 1408 584 cmd.exe WMIC.exe PID 1996 wrote to memory of 1384 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1384 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1384 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1384 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1384 wrote to memory of 1056 1384 cmd.exe WMIC.exe PID 1384 wrote to memory of 1056 1384 cmd.exe WMIC.exe PID 1384 wrote to memory of 1056 1384 cmd.exe WMIC.exe PID 1996 wrote to memory of 260 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 260 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 260 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 260 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 260 wrote to memory of 1600 260 cmd.exe WMIC.exe PID 260 wrote to memory of 1600 260 cmd.exe WMIC.exe PID 260 wrote to memory of 1600 260 cmd.exe WMIC.exe PID 1996 wrote to memory of 856 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 856 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 856 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 856 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 856 wrote to memory of 1132 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1132 856 cmd.exe WMIC.exe PID 856 wrote to memory of 1132 856 cmd.exe WMIC.exe PID 1996 wrote to memory of 308 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 308 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 308 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 308 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 308 wrote to memory of 1928 308 cmd.exe WMIC.exe PID 308 wrote to memory of 1928 308 cmd.exe WMIC.exe PID 308 wrote to memory of 1928 308 cmd.exe WMIC.exe PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 1304 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1304 wrote to memory of 984 1304 cmd.exe WMIC.exe PID 1304 wrote to memory of 984 1304 cmd.exe WMIC.exe PID 1304 wrote to memory of 984 1304 cmd.exe WMIC.exe PID 1996 wrote to memory of 564 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 564 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 564 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 1996 wrote to memory of 564 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe PID 564 wrote to memory of 1844 564 cmd.exe WMIC.exe PID 564 wrote to memory of 1844 564 cmd.exe WMIC.exe PID 564 wrote to memory of 1844 564 cmd.exe WMIC.exe PID 1996 wrote to memory of 1100 1996 7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\7741970ab53794dfd0b27891a22edd2facf262e20744b9ac1830abb6a5bb0b2c.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:604 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:564 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete3⤵PID:1408
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete3⤵PID:1056
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete3⤵PID:1600
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete3⤵PID:1132
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete3⤵PID:1928
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete3⤵PID:984
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete3⤵PID:1844
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete2⤵PID:1100
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete3⤵PID:740
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete2⤵PID:1384
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete3⤵PID:1388
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284