Analysis
-
max time kernel
152s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 09:29
Static task
static1
Behavioral task
behavioral1
Sample
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe
Resource
win10v20210408
General
-
Target
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe
-
Size
192KB
-
MD5
6b2c004ab77290fec33d460930d08844
-
SHA1
3b5cfc88baa8bf78ec0b45dc07b3bbea9cdf35dc
-
SHA256
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e
-
SHA512
744e56785f42dea874cae577d59c93e14e538d920cb065acd74f9c67450d9d74ae70754c8aafe74d225b238e6b493a4b428098e1d75e6369356341a37fa49d5f
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RenameRestart.tiff 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File renamed C:\Users\Admin\Pictures\RenameRestart.tiff => C:\Users\Admin\Pictures\RenameRestart.tiff.JVUAE 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File renamed C:\Users\Admin\Pictures\RenameStep.png => C:\Users\Admin\Pictures\RenameStep.png.JVUAE 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File renamed C:\Users\Admin\Pictures\StopInvoke.png => C:\Users\Admin\Pictures\StopInvoke.png.JVUAE 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompleteResolve.crw => C:\Users\Admin\Pictures\CompleteResolve.crw.JVUAE 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File renamed C:\Users\Admin\Pictures\ProtectConfirm.png => C:\Users\Admin\Pictures\ProtectConfirm.png.JVUAE 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File renamed C:\Users\Admin\Pictures\RegisterUninstall.png => C:\Users\Admin\Pictures\RegisterUninstall.png.JVUAE 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe -
Drops desktop.ini file(s) 38 IoCs
Processes:
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Searches\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\WHOOSH.WAV 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\TOOLICON.ICO 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SHOW_01.MID 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK_F_COL.HXK 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR42F.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\readme.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296277.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\readme.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\classlist 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD05119_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01747_.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115835.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows NT 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File created C:\Program Files\Microsoft Games\FreeCell\en-US\readme.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00938_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.INF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\readme.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18250_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\master_preferences 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\readme.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.ini 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\REPTWIZ.POC 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\readme.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\readme.txt 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107350.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02794_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02439_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Hardcover.eftx 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chicago 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01123_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105380.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200383.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESNL.ICO 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Origin.thmx 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101865.BMP 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_F_COL.HXK 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exepid process 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1528 vssvc.exe Token: SeRestorePrivilege 1528 vssvc.exe Token: SeAuditPrivilege 1528 vssvc.exe Token: SeIncreaseQuotaPrivilege 1276 WMIC.exe Token: SeSecurityPrivilege 1276 WMIC.exe Token: SeTakeOwnershipPrivilege 1276 WMIC.exe Token: SeLoadDriverPrivilege 1276 WMIC.exe Token: SeSystemProfilePrivilege 1276 WMIC.exe Token: SeSystemtimePrivilege 1276 WMIC.exe Token: SeProfSingleProcessPrivilege 1276 WMIC.exe Token: SeIncBasePriorityPrivilege 1276 WMIC.exe Token: SeCreatePagefilePrivilege 1276 WMIC.exe Token: SeBackupPrivilege 1276 WMIC.exe Token: SeRestorePrivilege 1276 WMIC.exe Token: SeShutdownPrivilege 1276 WMIC.exe Token: SeDebugPrivilege 1276 WMIC.exe Token: SeSystemEnvironmentPrivilege 1276 WMIC.exe Token: SeRemoteShutdownPrivilege 1276 WMIC.exe Token: SeUndockPrivilege 1276 WMIC.exe Token: SeManageVolumePrivilege 1276 WMIC.exe Token: 33 1276 WMIC.exe Token: 34 1276 WMIC.exe Token: 35 1276 WMIC.exe Token: SeIncreaseQuotaPrivilege 1276 WMIC.exe Token: SeSecurityPrivilege 1276 WMIC.exe Token: SeTakeOwnershipPrivilege 1276 WMIC.exe Token: SeLoadDriverPrivilege 1276 WMIC.exe Token: SeSystemProfilePrivilege 1276 WMIC.exe Token: SeSystemtimePrivilege 1276 WMIC.exe Token: SeProfSingleProcessPrivilege 1276 WMIC.exe Token: SeIncBasePriorityPrivilege 1276 WMIC.exe Token: SeCreatePagefilePrivilege 1276 WMIC.exe Token: SeBackupPrivilege 1276 WMIC.exe Token: SeRestorePrivilege 1276 WMIC.exe Token: SeShutdownPrivilege 1276 WMIC.exe Token: SeDebugPrivilege 1276 WMIC.exe Token: SeSystemEnvironmentPrivilege 1276 WMIC.exe Token: SeRemoteShutdownPrivilege 1276 WMIC.exe Token: SeUndockPrivilege 1276 WMIC.exe Token: SeManageVolumePrivilege 1276 WMIC.exe Token: 33 1276 WMIC.exe Token: 34 1276 WMIC.exe Token: 35 1276 WMIC.exe Token: SeIncreaseQuotaPrivilege 684 WMIC.exe Token: SeSecurityPrivilege 684 WMIC.exe Token: SeTakeOwnershipPrivilege 684 WMIC.exe Token: SeLoadDriverPrivilege 684 WMIC.exe Token: SeSystemProfilePrivilege 684 WMIC.exe Token: SeSystemtimePrivilege 684 WMIC.exe Token: SeProfSingleProcessPrivilege 684 WMIC.exe Token: SeIncBasePriorityPrivilege 684 WMIC.exe Token: SeCreatePagefilePrivilege 684 WMIC.exe Token: SeBackupPrivilege 684 WMIC.exe Token: SeRestorePrivilege 684 WMIC.exe Token: SeShutdownPrivilege 684 WMIC.exe Token: SeDebugPrivilege 684 WMIC.exe Token: SeSystemEnvironmentPrivilege 684 WMIC.exe Token: SeRemoteShutdownPrivilege 684 WMIC.exe Token: SeUndockPrivilege 684 WMIC.exe Token: SeManageVolumePrivilege 684 WMIC.exe Token: 33 684 WMIC.exe Token: 34 684 WMIC.exe Token: 35 684 WMIC.exe Token: SeIncreaseQuotaPrivilege 684 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2008 wrote to memory of 320 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 320 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 320 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 320 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 320 wrote to memory of 1276 320 cmd.exe WMIC.exe PID 320 wrote to memory of 1276 320 cmd.exe WMIC.exe PID 320 wrote to memory of 1276 320 cmd.exe WMIC.exe PID 2008 wrote to memory of 552 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 552 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 552 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 552 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 552 wrote to memory of 684 552 cmd.exe WMIC.exe PID 552 wrote to memory of 684 552 cmd.exe WMIC.exe PID 552 wrote to memory of 684 552 cmd.exe WMIC.exe PID 2008 wrote to memory of 1176 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1176 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1176 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1176 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 1176 wrote to memory of 436 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 436 1176 cmd.exe WMIC.exe PID 1176 wrote to memory of 436 1176 cmd.exe WMIC.exe PID 2008 wrote to memory of 952 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 952 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 952 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 952 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 952 wrote to memory of 1960 952 cmd.exe WMIC.exe PID 952 wrote to memory of 1960 952 cmd.exe WMIC.exe PID 952 wrote to memory of 1960 952 cmd.exe WMIC.exe PID 2008 wrote to memory of 2044 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 2044 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 2044 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 2044 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2044 wrote to memory of 1460 2044 cmd.exe WMIC.exe PID 2044 wrote to memory of 1460 2044 cmd.exe WMIC.exe PID 2044 wrote to memory of 1460 2044 cmd.exe WMIC.exe PID 2008 wrote to memory of 1452 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1452 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1452 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1452 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 1452 wrote to memory of 1676 1452 cmd.exe WMIC.exe PID 1452 wrote to memory of 1676 1452 cmd.exe WMIC.exe PID 1452 wrote to memory of 1676 1452 cmd.exe WMIC.exe PID 2008 wrote to memory of 1768 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1768 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1768 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1768 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 1768 wrote to memory of 1672 1768 cmd.exe WMIC.exe PID 1768 wrote to memory of 1672 1768 cmd.exe WMIC.exe PID 1768 wrote to memory of 1672 1768 cmd.exe WMIC.exe PID 2008 wrote to memory of 1280 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1280 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1280 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1280 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 1280 wrote to memory of 1428 1280 cmd.exe WMIC.exe PID 1280 wrote to memory of 1428 1280 cmd.exe WMIC.exe PID 1280 wrote to memory of 1428 1280 cmd.exe WMIC.exe PID 2008 wrote to memory of 1808 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1808 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1808 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 2008 wrote to memory of 1808 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe PID 1808 wrote to memory of 588 1808 cmd.exe WMIC.exe PID 1808 wrote to memory of 588 1808 cmd.exe WMIC.exe PID 1808 wrote to memory of 588 1808 cmd.exe WMIC.exe PID 2008 wrote to memory of 540 2008 853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\853ee7f215135b9c0864bb442b19ce60bb02a27fd92220a07876d31fd097411e.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:684 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵PID:436
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵PID:1960
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵PID:1460
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵PID:1676
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵PID:1672
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵PID:1428
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵PID:588
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵PID:540
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵PID:1068
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵PID:1044
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵PID:1092
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵PID:2040
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵PID:1524
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1528