Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:36
Static task
static1
Behavioral task
behavioral1
Sample
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe
-
Size
196KB
-
MD5
9ba004f422e905f6f76082aa3cedbf93
-
SHA1
e7e475088f143e359d7fd1bed1e7adb3fa1e3e19
-
SHA256
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1
-
SHA512
c604b66193f7283f8cc3a5e68f06ced606d6f52364e23816a911f4eef24f277a1c86bb26daa8ea5625069d740ec281fafa25c03099ac104a91e9ca780bafc176
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\DenyProtect.tiff => C:\Users\Admin\Pictures\DenyProtect.tiff.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\TraceUnpublish.tiff 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\TraceUnpublish.tiff => C:\Users\Admin\Pictures\TraceUnpublish.tiff.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\UninstallWrite.crw => C:\Users\Admin\Pictures\UninstallWrite.crw.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnpublishRename.crw => C:\Users\Admin\Pictures\UnpublishRename.crw.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\WaitSync.tiff 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File renamed C:\Users\Admin\Pictures\WaitSync.tiff => C:\Users\Admin\Pictures\WaitSync.tiff.KHNIJ 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\DenyProtect.tiff 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\GRAY.pf 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\eu-es\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-de_de.gif 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_it.properties 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\hr-hr\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Roses.jpg 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\config.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.jpg 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_pl.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-disabled_32.svg 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\pt-br\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Java\jre1.8.0_66\lib\security\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help.webapp_3.6.300.v20140407-1855.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\VBOB6.CHM 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-pl.xrm-ms 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYHBD.TTC 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\uk-ua\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fi-fi\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pl-pl\ui-strings.js 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hr.pak 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\readme.txt 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymxl.ttf 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Drops file in Windows directory 4 IoCs
Processes:
ShellExperienceHost.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exepid process 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3080 vssvc.exe Token: SeRestorePrivilege 3080 vssvc.exe Token: SeAuditPrivilege 3080 vssvc.exe Token: SeIncreaseQuotaPrivilege 2324 WMIC.exe Token: SeSecurityPrivilege 2324 WMIC.exe Token: SeTakeOwnershipPrivilege 2324 WMIC.exe Token: SeLoadDriverPrivilege 2324 WMIC.exe Token: SeSystemProfilePrivilege 2324 WMIC.exe Token: SeSystemtimePrivilege 2324 WMIC.exe Token: SeProfSingleProcessPrivilege 2324 WMIC.exe Token: SeIncBasePriorityPrivilege 2324 WMIC.exe Token: SeCreatePagefilePrivilege 2324 WMIC.exe Token: SeBackupPrivilege 2324 WMIC.exe Token: SeRestorePrivilege 2324 WMIC.exe Token: SeShutdownPrivilege 2324 WMIC.exe Token: SeDebugPrivilege 2324 WMIC.exe Token: SeSystemEnvironmentPrivilege 2324 WMIC.exe Token: SeRemoteShutdownPrivilege 2324 WMIC.exe Token: SeUndockPrivilege 2324 WMIC.exe Token: SeManageVolumePrivilege 2324 WMIC.exe Token: 33 2324 WMIC.exe Token: 34 2324 WMIC.exe Token: 35 2324 WMIC.exe Token: 36 2324 WMIC.exe Token: SeIncreaseQuotaPrivilege 2324 WMIC.exe Token: SeSecurityPrivilege 2324 WMIC.exe Token: SeTakeOwnershipPrivilege 2324 WMIC.exe Token: SeLoadDriverPrivilege 2324 WMIC.exe Token: SeSystemProfilePrivilege 2324 WMIC.exe Token: SeSystemtimePrivilege 2324 WMIC.exe Token: SeProfSingleProcessPrivilege 2324 WMIC.exe Token: SeIncBasePriorityPrivilege 2324 WMIC.exe Token: SeCreatePagefilePrivilege 2324 WMIC.exe Token: SeBackupPrivilege 2324 WMIC.exe Token: SeRestorePrivilege 2324 WMIC.exe Token: SeShutdownPrivilege 2324 WMIC.exe Token: SeDebugPrivilege 2324 WMIC.exe Token: SeSystemEnvironmentPrivilege 2324 WMIC.exe Token: SeRemoteShutdownPrivilege 2324 WMIC.exe Token: SeUndockPrivilege 2324 WMIC.exe Token: SeManageVolumePrivilege 2324 WMIC.exe Token: 33 2324 WMIC.exe Token: 34 2324 WMIC.exe Token: 35 2324 WMIC.exe Token: 36 2324 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 828 ShellExperienceHost.exe 828 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.execmd.exedescription pid process target process PID 2524 wrote to memory of 3492 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 2524 wrote to memory of 3492 2524 9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe cmd.exe PID 3492 wrote to memory of 2324 3492 cmd.exe WMIC.exe PID 3492 wrote to memory of 2324 3492 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\9b9f4e16c8d266c20186eb17bc513e2ca4a0491cbd4deaf6d68cb72f332763c1.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2324-116-0x0000000000000000-mapping.dmp
-
memory/3492-115-0x0000000000000000-mapping.dmp
-
memory/3960-117-0x000002F4C6290000-0x000002F4C62A0000-memory.dmpFilesize
64KB
-
memory/3960-118-0x000002F4C6960000-0x000002F4C6970000-memory.dmpFilesize
64KB
-
memory/3960-119-0x000002F4C8FF0000-0x000002F4C8FF1000-memory.dmpFilesize
4KB