Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 09:39
Static task
static1
Behavioral task
behavioral1
Sample
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe
-
Size
208KB
-
MD5
a8ff5d8b106c677713362bc7565cb0fb
-
SHA1
ee29eaf5a39715f02d1b2c2e518ae14cc338d7c3
-
SHA256
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38
-
SHA512
d48d0326dc481a2d8ae02c5acf13380397079d0ea286fe1c591ee1da8b10bc40a50a2d6fbd899832bcfd0eb9af6fc6ecaa6026fbdc80070b647dbcef7206ce01
Malware Config
Extracted
C:\readme.txt
conti
polzarutu1982@protonmail.com
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\InitializeStep.tiff => C:\Users\Admin\Pictures\InitializeStep.tiff.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\MoveUnpublish.crw => C:\Users\Admin\Pictures\MoveUnpublish.crw.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\ReceiveSwitch.raw => C:\Users\Admin\Pictures\ReceiveSwitch.raw.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\RestartLimit.tif => C:\Users\Admin\Pictures\RestartLimit.tif.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\SendResolve.png => C:\Users\Admin\Pictures\SendResolve.png.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\TraceRestore.tiff => C:\Users\Admin\Pictures\TraceRestore.tiff.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\CheckpointClose.png => C:\Users\Admin\Pictures\CheckpointClose.png.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\EnterRead.tiff => C:\Users\Admin\Pictures\EnterRead.tiff.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\InitializeStep.tiff dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\LimitCompare.tif => C:\Users\Admin\Pictures\LimitCompare.tif.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\MountRedo.crw => C:\Users\Admin\Pictures\MountRedo.crw.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\RestoreProtect.raw => C:\Users\Admin\Pictures\RestoreProtect.raw.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\SyncExpand.tif => C:\Users\Admin\Pictures\SyncExpand.tif.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\TraceRestore.tiff dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\EnterRead.tiff dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387604.JPG dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\HWRCustomization\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Common Files\System\ado\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGDOTS.XML dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Common Files\System\msadc\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02756U.BMP dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME43.CSS dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02009_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.XML dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18249_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\WSS.ICO dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CUP.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01130_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_08.MID dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDBAR98.POC dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48F.GIF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1B.GIF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21423_.GIF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Manaus dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178639.JPG dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\THMBNAIL.PNG dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18221_.WMF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Fancy.dotx dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL109.XML dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN065.XML dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exepid process 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 964 vssvc.exe Token: SeRestorePrivilege 964 vssvc.exe Token: SeAuditPrivilege 964 vssvc.exe Token: SeIncreaseQuotaPrivilege 784 WMIC.exe Token: SeSecurityPrivilege 784 WMIC.exe Token: SeTakeOwnershipPrivilege 784 WMIC.exe Token: SeLoadDriverPrivilege 784 WMIC.exe Token: SeSystemProfilePrivilege 784 WMIC.exe Token: SeSystemtimePrivilege 784 WMIC.exe Token: SeProfSingleProcessPrivilege 784 WMIC.exe Token: SeIncBasePriorityPrivilege 784 WMIC.exe Token: SeCreatePagefilePrivilege 784 WMIC.exe Token: SeBackupPrivilege 784 WMIC.exe Token: SeRestorePrivilege 784 WMIC.exe Token: SeShutdownPrivilege 784 WMIC.exe Token: SeDebugPrivilege 784 WMIC.exe Token: SeSystemEnvironmentPrivilege 784 WMIC.exe Token: SeRemoteShutdownPrivilege 784 WMIC.exe Token: SeUndockPrivilege 784 WMIC.exe Token: SeManageVolumePrivilege 784 WMIC.exe Token: 33 784 WMIC.exe Token: 34 784 WMIC.exe Token: 35 784 WMIC.exe Token: SeIncreaseQuotaPrivilege 784 WMIC.exe Token: SeSecurityPrivilege 784 WMIC.exe Token: SeTakeOwnershipPrivilege 784 WMIC.exe Token: SeLoadDriverPrivilege 784 WMIC.exe Token: SeSystemProfilePrivilege 784 WMIC.exe Token: SeSystemtimePrivilege 784 WMIC.exe Token: SeProfSingleProcessPrivilege 784 WMIC.exe Token: SeIncBasePriorityPrivilege 784 WMIC.exe Token: SeCreatePagefilePrivilege 784 WMIC.exe Token: SeBackupPrivilege 784 WMIC.exe Token: SeRestorePrivilege 784 WMIC.exe Token: SeShutdownPrivilege 784 WMIC.exe Token: SeDebugPrivilege 784 WMIC.exe Token: SeSystemEnvironmentPrivilege 784 WMIC.exe Token: SeRemoteShutdownPrivilege 784 WMIC.exe Token: SeUndockPrivilege 784 WMIC.exe Token: SeManageVolumePrivilege 784 WMIC.exe Token: 33 784 WMIC.exe Token: 34 784 WMIC.exe Token: 35 784 WMIC.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe Token: SeSecurityPrivilege 584 WMIC.exe Token: SeTakeOwnershipPrivilege 584 WMIC.exe Token: SeLoadDriverPrivilege 584 WMIC.exe Token: SeSystemProfilePrivilege 584 WMIC.exe Token: SeSystemtimePrivilege 584 WMIC.exe Token: SeProfSingleProcessPrivilege 584 WMIC.exe Token: SeIncBasePriorityPrivilege 584 WMIC.exe Token: SeCreatePagefilePrivilege 584 WMIC.exe Token: SeBackupPrivilege 584 WMIC.exe Token: SeRestorePrivilege 584 WMIC.exe Token: SeShutdownPrivilege 584 WMIC.exe Token: SeDebugPrivilege 584 WMIC.exe Token: SeSystemEnvironmentPrivilege 584 WMIC.exe Token: SeRemoteShutdownPrivilege 584 WMIC.exe Token: SeUndockPrivilege 584 WMIC.exe Token: SeManageVolumePrivilege 584 WMIC.exe Token: 33 584 WMIC.exe Token: 34 584 WMIC.exe Token: 35 584 WMIC.exe Token: SeIncreaseQuotaPrivilege 584 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1044 wrote to memory of 552 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 552 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 552 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 552 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 552 wrote to memory of 784 552 cmd.exe WMIC.exe PID 552 wrote to memory of 784 552 cmd.exe WMIC.exe PID 552 wrote to memory of 784 552 cmd.exe WMIC.exe PID 1044 wrote to memory of 1472 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1472 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1472 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1472 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1472 wrote to memory of 584 1472 cmd.exe WMIC.exe PID 1472 wrote to memory of 584 1472 cmd.exe WMIC.exe PID 1472 wrote to memory of 584 1472 cmd.exe WMIC.exe PID 1044 wrote to memory of 1652 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1652 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1652 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1652 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1652 wrote to memory of 1584 1652 cmd.exe WMIC.exe PID 1652 wrote to memory of 1584 1652 cmd.exe WMIC.exe PID 1652 wrote to memory of 1584 1652 cmd.exe WMIC.exe PID 1044 wrote to memory of 1812 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1812 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1812 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1812 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1812 wrote to memory of 1164 1812 cmd.exe WMIC.exe PID 1812 wrote to memory of 1164 1812 cmd.exe WMIC.exe PID 1812 wrote to memory of 1164 1812 cmd.exe WMIC.exe PID 1044 wrote to memory of 1820 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1820 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1820 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1820 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1820 wrote to memory of 1248 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 1248 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 1248 1820 cmd.exe WMIC.exe PID 1044 wrote to memory of 768 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 768 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 768 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 768 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 768 wrote to memory of 1712 768 cmd.exe WMIC.exe PID 768 wrote to memory of 1712 768 cmd.exe WMIC.exe PID 768 wrote to memory of 1712 768 cmd.exe WMIC.exe PID 1044 wrote to memory of 1740 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1740 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1740 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1740 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1608 1740 cmd.exe WMIC.exe PID 1740 wrote to memory of 1608 1740 cmd.exe WMIC.exe PID 1740 wrote to memory of 1608 1740 cmd.exe WMIC.exe PID 1044 wrote to memory of 332 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 332 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 332 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 332 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 332 wrote to memory of 564 332 cmd.exe WMIC.exe PID 332 wrote to memory of 564 332 cmd.exe WMIC.exe PID 332 wrote to memory of 564 332 cmd.exe WMIC.exe PID 1044 wrote to memory of 1132 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1132 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1132 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1044 wrote to memory of 1132 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 1132 wrote to memory of 344 1132 cmd.exe WMIC.exe PID 1132 wrote to memory of 344 1132 cmd.exe WMIC.exe PID 1132 wrote to memory of 344 1132 cmd.exe WMIC.exe PID 1044 wrote to memory of 1472 1044 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/288-75-0x0000000000000000-mapping.dmp
-
memory/332-69-0x0000000000000000-mapping.dmp
-
memory/344-72-0x0000000000000000-mapping.dmp
-
memory/544-74-0x0000000000000000-mapping.dmp
-
memory/552-55-0x0000000000000000-mapping.dmp
-
memory/564-70-0x0000000000000000-mapping.dmp
-
memory/584-58-0x0000000000000000-mapping.dmp
-
memory/768-65-0x0000000000000000-mapping.dmp
-
memory/784-56-0x0000000000000000-mapping.dmp
-
memory/1044-54-0x0000000075871000-0x0000000075873000-memory.dmpFilesize
8KB
-
memory/1132-71-0x0000000000000000-mapping.dmp
-
memory/1164-62-0x0000000000000000-mapping.dmp
-
memory/1248-64-0x0000000000000000-mapping.dmp
-
memory/1472-73-0x0000000000000000-mapping.dmp
-
memory/1472-57-0x0000000000000000-mapping.dmp
-
memory/1572-76-0x0000000000000000-mapping.dmp
-
memory/1584-60-0x0000000000000000-mapping.dmp
-
memory/1608-68-0x0000000000000000-mapping.dmp
-
memory/1648-78-0x0000000000000000-mapping.dmp
-
memory/1652-59-0x0000000000000000-mapping.dmp
-
memory/1712-66-0x0000000000000000-mapping.dmp
-
memory/1740-67-0x0000000000000000-mapping.dmp
-
memory/1812-61-0x0000000000000000-mapping.dmp
-
memory/1812-77-0x0000000000000000-mapping.dmp
-
memory/1820-63-0x0000000000000000-mapping.dmp