Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 09:28
Static task
static1
Behavioral task
behavioral1
Sample
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe
Resource
win10v20210408
General
-
Target
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe
-
Size
196KB
-
MD5
3321c504d71b9782920fae791289ed21
-
SHA1
6039f3dd5e743024ed9d9013fb603a7051d2df00
-
SHA256
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3
-
SHA512
f694ec9f2ea38cc62d95f408bfbfaa1061ac99e5ebe9ed986326e342594a5dc7cde2895dbf32ffe519cbdc98fe564e33d91102f4fdde8b91b006cf7c53ddb645
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\PublishPush.png => C:\Users\Admin\Pictures\PublishPush.png.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\ShowLimit.png => C:\Users\Admin\Pictures\ShowLimit.png.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\ClearMeasure.tiff 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\ClearMeasure.tiff => C:\Users\Admin\Pictures\ClearMeasure.tiff.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\CompressCheckpoint.tiff 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\EnterRead.png => C:\Users\Admin\Pictures\EnterRead.png.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompressCheckpoint.tiff => C:\Users\Admin\Pictures\CompressCheckpoint.tiff.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\ReceiveConvert.png => C:\Users\Admin\Pictures\ReceiveConvert.png.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\SaveUnblock.tif => C:\Users\Admin\Pictures\SaveUnblock.tif.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File renamed C:\Users\Admin\Pictures\SkipGet.crw => C:\Users\Admin\Pictures\SkipGet.crw.VTOXR 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Triedit\en-US\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightDemiItalic.ttf 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-cli.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ppd.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\id.pak 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansRegular.ttf 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.rll 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\Java\jre1.8.0_66\lib\management\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-search.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.htm 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\dt.jar 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File created C:\Program Files (x86)\Common Files\System\ado\readme.txt 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\GreenBubbles.jpg 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Marquee.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Drops file in Windows directory 2 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exepid process 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4864 vssvc.exe Token: SeRestorePrivilege 4864 vssvc.exe Token: SeAuditPrivilege 4864 vssvc.exe Token: SeIncreaseQuotaPrivilege 4984 WMIC.exe Token: SeSecurityPrivilege 4984 WMIC.exe Token: SeTakeOwnershipPrivilege 4984 WMIC.exe Token: SeLoadDriverPrivilege 4984 WMIC.exe Token: SeSystemProfilePrivilege 4984 WMIC.exe Token: SeSystemtimePrivilege 4984 WMIC.exe Token: SeProfSingleProcessPrivilege 4984 WMIC.exe Token: SeIncBasePriorityPrivilege 4984 WMIC.exe Token: SeCreatePagefilePrivilege 4984 WMIC.exe Token: SeBackupPrivilege 4984 WMIC.exe Token: SeRestorePrivilege 4984 WMIC.exe Token: SeShutdownPrivilege 4984 WMIC.exe Token: SeDebugPrivilege 4984 WMIC.exe Token: SeSystemEnvironmentPrivilege 4984 WMIC.exe Token: SeRemoteShutdownPrivilege 4984 WMIC.exe Token: SeUndockPrivilege 4984 WMIC.exe Token: SeManageVolumePrivilege 4984 WMIC.exe Token: 33 4984 WMIC.exe Token: 34 4984 WMIC.exe Token: 35 4984 WMIC.exe Token: 36 4984 WMIC.exe Token: SeIncreaseQuotaPrivilege 4984 WMIC.exe Token: SeSecurityPrivilege 4984 WMIC.exe Token: SeTakeOwnershipPrivilege 4984 WMIC.exe Token: SeLoadDriverPrivilege 4984 WMIC.exe Token: SeSystemProfilePrivilege 4984 WMIC.exe Token: SeSystemtimePrivilege 4984 WMIC.exe Token: SeProfSingleProcessPrivilege 4984 WMIC.exe Token: SeIncBasePriorityPrivilege 4984 WMIC.exe Token: SeCreatePagefilePrivilege 4984 WMIC.exe Token: SeBackupPrivilege 4984 WMIC.exe Token: SeRestorePrivilege 4984 WMIC.exe Token: SeShutdownPrivilege 4984 WMIC.exe Token: SeDebugPrivilege 4984 WMIC.exe Token: SeSystemEnvironmentPrivilege 4984 WMIC.exe Token: SeRemoteShutdownPrivilege 4984 WMIC.exe Token: SeUndockPrivilege 4984 WMIC.exe Token: SeManageVolumePrivilege 4984 WMIC.exe Token: 33 4984 WMIC.exe Token: 34 4984 WMIC.exe Token: 35 4984 WMIC.exe Token: 36 4984 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 632 ShellExperienceHost.exe 632 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.execmd.exedescription pid process target process PID 4800 wrote to memory of 4948 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 4800 wrote to memory of 4948 4800 7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe cmd.exe PID 4948 wrote to memory of 4984 4948 cmd.exe WMIC.exe PID 4948 wrote to memory of 4984 4948 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\7e6d9a7da47d46be2a836c1779bb1616fba4f7c7187d71f66cff3a790f804ec3.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2112
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
PID:1052