Analysis
-
max time kernel
153s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 09:28
Static task
static1
Behavioral task
behavioral1
Sample
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe
Resource
win10v20210408
General
-
Target
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe
-
Size
196KB
-
MD5
3321c504d71b9782920fae791289ed21
-
SHA1
6039f3dd5e743024ed9d9013fb603a7051d2df00
-
SHA256
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3
-
SHA512
f694ec9f2ea38cc62d95f408bfbfaa1061ac99e5ebe9ed986326e342594a5dc7cde2895dbf32ffe519cbdc98fe564e33d91102f4fdde8b91b006cf7c53ddb645
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\MountNew.tiff 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\MountNew.tiff => C:\Users\Admin\Pictures\MountNew.tiff.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\StopMount.png => C:\Users\Admin\Pictures\StopMount.png.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\TestSkip.raw => C:\Users\Admin\Pictures\TestSkip.raw.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\UninstallBlock.tif => C:\Users\Admin\Pictures\UninstallBlock.tif.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnprotectSave.raw => C:\Users\Admin\Pictures\UnprotectSave.raw.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompleteCompress.crw => C:\Users\Admin\Pictures\CompleteCompress.crw.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\FormatPush.png => C:\Users\Admin\Pictures\FormatPush.png.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Drops desktop.ini file(s) 38 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.ELM 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02267_.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\REPTWIZ.POC 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15018_.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45B.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185778.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00735_.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.security 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImages.jpg 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB02229_.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BZCRD98.POC 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR36B.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240189.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7B.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogo.png 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Solstice.thmx 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\STRTEDGE.ELM 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Easter 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\classlist 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151061.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\LEVEL.INF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ro.pak 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01745_.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\PREVIEW.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090390.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\fr-FR\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115839.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02282_.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01174_.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14528_.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02153_.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00734_.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297707.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\JUNGLE.HTM 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUTL.OLB 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200189.WMF 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exepid process 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 972 vssvc.exe Token: SeRestorePrivilege 972 vssvc.exe Token: SeAuditPrivilege 972 vssvc.exe Token: SeIncreaseQuotaPrivilege 740 WMIC.exe Token: SeSecurityPrivilege 740 WMIC.exe Token: SeTakeOwnershipPrivilege 740 WMIC.exe Token: SeLoadDriverPrivilege 740 WMIC.exe Token: SeSystemProfilePrivilege 740 WMIC.exe Token: SeSystemtimePrivilege 740 WMIC.exe Token: SeProfSingleProcessPrivilege 740 WMIC.exe Token: SeIncBasePriorityPrivilege 740 WMIC.exe Token: SeCreatePagefilePrivilege 740 WMIC.exe Token: SeBackupPrivilege 740 WMIC.exe Token: SeRestorePrivilege 740 WMIC.exe Token: SeShutdownPrivilege 740 WMIC.exe Token: SeDebugPrivilege 740 WMIC.exe Token: SeSystemEnvironmentPrivilege 740 WMIC.exe Token: SeRemoteShutdownPrivilege 740 WMIC.exe Token: SeUndockPrivilege 740 WMIC.exe Token: SeManageVolumePrivilege 740 WMIC.exe Token: 33 740 WMIC.exe Token: 34 740 WMIC.exe Token: 35 740 WMIC.exe Token: SeIncreaseQuotaPrivilege 740 WMIC.exe Token: SeSecurityPrivilege 740 WMIC.exe Token: SeTakeOwnershipPrivilege 740 WMIC.exe Token: SeLoadDriverPrivilege 740 WMIC.exe Token: SeSystemProfilePrivilege 740 WMIC.exe Token: SeSystemtimePrivilege 740 WMIC.exe Token: SeProfSingleProcessPrivilege 740 WMIC.exe Token: SeIncBasePriorityPrivilege 740 WMIC.exe Token: SeCreatePagefilePrivilege 740 WMIC.exe Token: SeBackupPrivilege 740 WMIC.exe Token: SeRestorePrivilege 740 WMIC.exe Token: SeShutdownPrivilege 740 WMIC.exe Token: SeDebugPrivilege 740 WMIC.exe Token: SeSystemEnvironmentPrivilege 740 WMIC.exe Token: SeRemoteShutdownPrivilege 740 WMIC.exe Token: SeUndockPrivilege 740 WMIC.exe Token: SeManageVolumePrivilege 740 WMIC.exe Token: 33 740 WMIC.exe Token: 34 740 WMIC.exe Token: 35 740 WMIC.exe Token: SeIncreaseQuotaPrivilege 1484 WMIC.exe Token: SeSecurityPrivilege 1484 WMIC.exe Token: SeTakeOwnershipPrivilege 1484 WMIC.exe Token: SeLoadDriverPrivilege 1484 WMIC.exe Token: SeSystemProfilePrivilege 1484 WMIC.exe Token: SeSystemtimePrivilege 1484 WMIC.exe Token: SeProfSingleProcessPrivilege 1484 WMIC.exe Token: SeIncBasePriorityPrivilege 1484 WMIC.exe Token: SeCreatePagefilePrivilege 1484 WMIC.exe Token: SeBackupPrivilege 1484 WMIC.exe Token: SeRestorePrivilege 1484 WMIC.exe Token: SeShutdownPrivilege 1484 WMIC.exe Token: SeDebugPrivilege 1484 WMIC.exe Token: SeSystemEnvironmentPrivilege 1484 WMIC.exe Token: SeRemoteShutdownPrivilege 1484 WMIC.exe Token: SeUndockPrivilege 1484 WMIC.exe Token: SeManageVolumePrivilege 1484 WMIC.exe Token: 33 1484 WMIC.exe Token: 34 1484 WMIC.exe Token: 35 1484 WMIC.exe Token: SeIncreaseQuotaPrivilege 1484 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1116 wrote to memory of 524 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 524 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 524 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 524 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 524 wrote to memory of 740 524 cmd.exe WMIC.exe PID 524 wrote to memory of 740 524 cmd.exe WMIC.exe PID 524 wrote to memory of 740 524 cmd.exe WMIC.exe PID 1116 wrote to memory of 1440 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1440 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1440 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1440 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1440 wrote to memory of 1484 1440 cmd.exe WMIC.exe PID 1440 wrote to memory of 1484 1440 cmd.exe WMIC.exe PID 1440 wrote to memory of 1484 1440 cmd.exe WMIC.exe PID 1116 wrote to memory of 616 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 616 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 616 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 616 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 616 wrote to memory of 964 616 cmd.exe WMIC.exe PID 616 wrote to memory of 964 616 cmd.exe WMIC.exe PID 616 wrote to memory of 964 616 cmd.exe WMIC.exe PID 1116 wrote to memory of 1120 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1120 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1120 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1120 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1120 wrote to memory of 1252 1120 cmd.exe WMIC.exe PID 1120 wrote to memory of 1252 1120 cmd.exe WMIC.exe PID 1120 wrote to memory of 1252 1120 cmd.exe WMIC.exe PID 1116 wrote to memory of 1956 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1956 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1956 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1956 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1956 wrote to memory of 1468 1956 cmd.exe WMIC.exe PID 1956 wrote to memory of 1468 1956 cmd.exe WMIC.exe PID 1956 wrote to memory of 1468 1956 cmd.exe WMIC.exe PID 1116 wrote to memory of 984 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 984 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 984 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 984 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 984 wrote to memory of 1924 984 cmd.exe WMIC.exe PID 984 wrote to memory of 1924 984 cmd.exe WMIC.exe PID 984 wrote to memory of 1924 984 cmd.exe WMIC.exe PID 1116 wrote to memory of 1064 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1064 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1064 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1064 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1064 wrote to memory of 1636 1064 cmd.exe WMIC.exe PID 1064 wrote to memory of 1636 1064 cmd.exe WMIC.exe PID 1064 wrote to memory of 1636 1064 cmd.exe WMIC.exe PID 1116 wrote to memory of 1184 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1184 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1184 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 1184 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1184 wrote to memory of 860 1184 cmd.exe WMIC.exe PID 1184 wrote to memory of 860 1184 cmd.exe WMIC.exe PID 1184 wrote to memory of 860 1184 cmd.exe WMIC.exe PID 1116 wrote to memory of 792 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 792 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 792 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 1116 wrote to memory of 792 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 792 wrote to memory of 996 792 cmd.exe WMIC.exe PID 792 wrote to memory of 996 792 cmd.exe WMIC.exe PID 792 wrote to memory of 996 792 cmd.exe WMIC.exe PID 1116 wrote to memory of 924 1116 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:740 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵PID:964
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵PID:1252
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵PID:1468
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵PID:1924
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵PID:1636
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵PID:860
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵PID:996
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵PID:924
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵PID:828
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵PID:1076
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵PID:1052
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵PID:1644
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵PID:1192
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:972