Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 09:36
Static task
static1
Behavioral task
behavioral1
Sample
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe
-
Size
196KB
-
MD5
9ba004f422e905f6f76082aa3cedbf93
-
SHA1
e7e475088f143e359d7fd1bed1e7adb3fa1e3e19
-
SHA256
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1
-
SHA512
c604b66193f7283f8cc3a5e68f06ced606d6f52364e23816a911f4eef24f277a1c86bb26daa8ea5625069d740ec281fafa25c03099ac104a91e9ca780bafc176
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\DenyUnregister.raw => C:\Users\Admin\Pictures\DenyUnregister.raw.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\DisconnectPop.tif => C:\Users\Admin\Pictures\DisconnectPop.tif.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\DismountSubmit.tiff => C:\Users\Admin\Pictures\DismountSubmit.tiff.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\EnableSuspend.png => C:\Users\Admin\Pictures\EnableSuspend.png.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\MeasureSelect.raw => C:\Users\Admin\Pictures\MeasureSelect.raw.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnregisterMount.crw => C:\Users\Admin\Pictures\UnregisterMount.crw.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\ReadMount.tif => C:\Users\Admin\Pictures\ReadMount.tif.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\AssertInstall.tif => C:\Users\Admin\Pictures\AssertInstall.tif.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompressRestart.tif => C:\Users\Admin\Pictures\CompressRestart.tif.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\DismountSubmit.tiff 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExpandRegister.png => C:\Users\Admin\Pictures\ExpandRegister.png.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\InitializeRepair.tiff 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\InitializeRepair.tiff => C:\Users\Admin\Pictures\InitializeRepair.tiff.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\MountRegister.tif => C:\Users\Admin\Pictures\MountRegister.tif.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exedescription ioc process File opened for modification C:\Users\Public\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382942.JPG 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01785_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107516.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SPRNG_01.MID 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Metlakatla 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveNoise.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\COPYRIGHT 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01239K.JPG 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00942_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01158_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.XML 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\TAB_ON.GIF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\calendars.properties 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_right.gif 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227419.JPG 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\WHOOSH.WAV 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETSM.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\MTEXTRA.TTF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Java\jre7\bin\plugin2\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107342.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART8.BDR 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00513_.WMF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00673L.GIF 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exepid process 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1564 vssvc.exe Token: SeRestorePrivilege 1564 vssvc.exe Token: SeAuditPrivilege 1564 vssvc.exe Token: SeIncreaseQuotaPrivilege 556 WMIC.exe Token: SeSecurityPrivilege 556 WMIC.exe Token: SeTakeOwnershipPrivilege 556 WMIC.exe Token: SeLoadDriverPrivilege 556 WMIC.exe Token: SeSystemProfilePrivilege 556 WMIC.exe Token: SeSystemtimePrivilege 556 WMIC.exe Token: SeProfSingleProcessPrivilege 556 WMIC.exe Token: SeIncBasePriorityPrivilege 556 WMIC.exe Token: SeCreatePagefilePrivilege 556 WMIC.exe Token: SeBackupPrivilege 556 WMIC.exe Token: SeRestorePrivilege 556 WMIC.exe Token: SeShutdownPrivilege 556 WMIC.exe Token: SeDebugPrivilege 556 WMIC.exe Token: SeSystemEnvironmentPrivilege 556 WMIC.exe Token: SeRemoteShutdownPrivilege 556 WMIC.exe Token: SeUndockPrivilege 556 WMIC.exe Token: SeManageVolumePrivilege 556 WMIC.exe Token: 33 556 WMIC.exe Token: 34 556 WMIC.exe Token: 35 556 WMIC.exe Token: SeIncreaseQuotaPrivilege 556 WMIC.exe Token: SeSecurityPrivilege 556 WMIC.exe Token: SeTakeOwnershipPrivilege 556 WMIC.exe Token: SeLoadDriverPrivilege 556 WMIC.exe Token: SeSystemProfilePrivilege 556 WMIC.exe Token: SeSystemtimePrivilege 556 WMIC.exe Token: SeProfSingleProcessPrivilege 556 WMIC.exe Token: SeIncBasePriorityPrivilege 556 WMIC.exe Token: SeCreatePagefilePrivilege 556 WMIC.exe Token: SeBackupPrivilege 556 WMIC.exe Token: SeRestorePrivilege 556 WMIC.exe Token: SeShutdownPrivilege 556 WMIC.exe Token: SeDebugPrivilege 556 WMIC.exe Token: SeSystemEnvironmentPrivilege 556 WMIC.exe Token: SeRemoteShutdownPrivilege 556 WMIC.exe Token: SeUndockPrivilege 556 WMIC.exe Token: SeManageVolumePrivilege 556 WMIC.exe Token: 33 556 WMIC.exe Token: 34 556 WMIC.exe Token: 35 556 WMIC.exe Token: SeIncreaseQuotaPrivilege 1248 WMIC.exe Token: SeSecurityPrivilege 1248 WMIC.exe Token: SeTakeOwnershipPrivilege 1248 WMIC.exe Token: SeLoadDriverPrivilege 1248 WMIC.exe Token: SeSystemProfilePrivilege 1248 WMIC.exe Token: SeSystemtimePrivilege 1248 WMIC.exe Token: SeProfSingleProcessPrivilege 1248 WMIC.exe Token: SeIncBasePriorityPrivilege 1248 WMIC.exe Token: SeCreatePagefilePrivilege 1248 WMIC.exe Token: SeBackupPrivilege 1248 WMIC.exe Token: SeRestorePrivilege 1248 WMIC.exe Token: SeShutdownPrivilege 1248 WMIC.exe Token: SeDebugPrivilege 1248 WMIC.exe Token: SeSystemEnvironmentPrivilege 1248 WMIC.exe Token: SeRemoteShutdownPrivilege 1248 WMIC.exe Token: SeUndockPrivilege 1248 WMIC.exe Token: SeManageVolumePrivilege 1248 WMIC.exe Token: 33 1248 WMIC.exe Token: 34 1248 WMIC.exe Token: 35 1248 WMIC.exe Token: SeIncreaseQuotaPrivilege 1248 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1268 wrote to memory of 1100 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1100 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1100 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1100 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1100 wrote to memory of 556 1100 cmd.exe WMIC.exe PID 1100 wrote to memory of 556 1100 cmd.exe WMIC.exe PID 1100 wrote to memory of 556 1100 cmd.exe WMIC.exe PID 1268 wrote to memory of 1620 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1620 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1620 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1620 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1620 wrote to memory of 1248 1620 cmd.exe WMIC.exe PID 1620 wrote to memory of 1248 1620 cmd.exe WMIC.exe PID 1620 wrote to memory of 1248 1620 cmd.exe WMIC.exe PID 1268 wrote to memory of 1392 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1392 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1392 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1392 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1392 wrote to memory of 1080 1392 cmd.exe WMIC.exe PID 1392 wrote to memory of 1080 1392 cmd.exe WMIC.exe PID 1392 wrote to memory of 1080 1392 cmd.exe WMIC.exe PID 1268 wrote to memory of 1188 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1188 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1188 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1188 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1188 wrote to memory of 1516 1188 cmd.exe WMIC.exe PID 1188 wrote to memory of 1516 1188 cmd.exe WMIC.exe PID 1188 wrote to memory of 1516 1188 cmd.exe WMIC.exe PID 1268 wrote to memory of 1464 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1464 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1464 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1464 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1464 wrote to memory of 1664 1464 cmd.exe WMIC.exe PID 1464 wrote to memory of 1664 1464 cmd.exe WMIC.exe PID 1464 wrote to memory of 1664 1464 cmd.exe WMIC.exe PID 1268 wrote to memory of 1832 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1832 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1832 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1832 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1832 wrote to memory of 1748 1832 cmd.exe WMIC.exe PID 1832 wrote to memory of 1748 1832 cmd.exe WMIC.exe PID 1832 wrote to memory of 1748 1832 cmd.exe WMIC.exe PID 1268 wrote to memory of 1472 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1472 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1472 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1472 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1216 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1216 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1216 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1216 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1216 wrote to memory of 664 1216 cmd.exe WMIC.exe PID 1216 wrote to memory of 664 1216 cmd.exe WMIC.exe PID 1216 wrote to memory of 664 1216 cmd.exe WMIC.exe PID 1268 wrote to memory of 1288 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1288 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1288 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1288 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1288 wrote to memory of 1700 1288 cmd.exe WMIC.exe PID 1288 wrote to memory of 1700 1288 cmd.exe WMIC.exe PID 1288 wrote to memory of 1700 1288 cmd.exe WMIC.exe PID 1268 wrote to memory of 1648 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1648 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1648 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 1268 wrote to memory of 1648 1268 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/556-56-0x0000000000000000-mapping.dmp
-
memory/664-69-0x0000000000000000-mapping.dmp
-
memory/956-74-0x0000000000000000-mapping.dmp
-
memory/1000-76-0x0000000000000000-mapping.dmp
-
memory/1080-60-0x0000000000000000-mapping.dmp
-
memory/1100-55-0x0000000000000000-mapping.dmp
-
memory/1188-61-0x0000000000000000-mapping.dmp
-
memory/1216-68-0x0000000000000000-mapping.dmp
-
memory/1248-58-0x0000000000000000-mapping.dmp
-
memory/1268-54-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1288-70-0x0000000000000000-mapping.dmp
-
memory/1392-59-0x0000000000000000-mapping.dmp
-
memory/1464-63-0x0000000000000000-mapping.dmp
-
memory/1472-67-0x0000000000000000-mapping.dmp
-
memory/1480-75-0x0000000000000000-mapping.dmp
-
memory/1516-62-0x0000000000000000-mapping.dmp
-
memory/1520-77-0x0000000000000000-mapping.dmp
-
memory/1620-57-0x0000000000000000-mapping.dmp
-
memory/1648-72-0x0000000000000000-mapping.dmp
-
memory/1664-64-0x0000000000000000-mapping.dmp
-
memory/1700-71-0x0000000000000000-mapping.dmp
-
memory/1748-66-0x0000000000000000-mapping.dmp
-
memory/1832-65-0x0000000000000000-mapping.dmp
-
memory/2016-73-0x0000000000000000-mapping.dmp