Analysis
-
max time kernel
152s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:39
Static task
static1
Behavioral task
behavioral1
Sample
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe
-
Size
208KB
-
MD5
a8ff5d8b106c677713362bc7565cb0fb
-
SHA1
ee29eaf5a39715f02d1b2c2e518ae14cc338d7c3
-
SHA256
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38
-
SHA512
d48d0326dc481a2d8ae02c5acf13380397079d0ea286fe1c591ee1da8b10bc40a50a2d6fbd899832bcfd0eb9af6fc6ecaa6026fbdc80070b647dbcef7206ce01
Malware Config
Extracted
C:\readme.txt
conti
polzarutu1982@protonmail.com
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\UnpublishUpdate.png => C:\Users\Admin\Pictures\UnpublishUpdate.png.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\WatchDisable.png => C:\Users\Admin\Pictures\WatchDisable.png.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\BlockSkip.tif => C:\Users\Admin\Pictures\BlockSkip.tif.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File renamed C:\Users\Admin\Pictures\DismountUninstall.png => C:\Users\Admin\Pictures\DismountUninstall.png.CECJF dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\ui-strings.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-selector.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\1033\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-ma\ui-strings.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\ui-strings.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\es-es\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo@2x.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-cn\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.war dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\cloud_icon.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ru-ru\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\large_trefoil_2x.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_2x.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lt.pak dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\readme.txt dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ru-ru\ui-strings.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\ui-strings.js dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.htm dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_bow.png dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Drops file in Windows directory 4 IoCs
Processes:
ShellExperienceHost.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exepid process 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4160 vssvc.exe Token: SeRestorePrivilege 4160 vssvc.exe Token: SeAuditPrivilege 4160 vssvc.exe Token: SeIncreaseQuotaPrivilege 3292 WMIC.exe Token: SeSecurityPrivilege 3292 WMIC.exe Token: SeTakeOwnershipPrivilege 3292 WMIC.exe Token: SeLoadDriverPrivilege 3292 WMIC.exe Token: SeSystemProfilePrivilege 3292 WMIC.exe Token: SeSystemtimePrivilege 3292 WMIC.exe Token: SeProfSingleProcessPrivilege 3292 WMIC.exe Token: SeIncBasePriorityPrivilege 3292 WMIC.exe Token: SeCreatePagefilePrivilege 3292 WMIC.exe Token: SeBackupPrivilege 3292 WMIC.exe Token: SeRestorePrivilege 3292 WMIC.exe Token: SeShutdownPrivilege 3292 WMIC.exe Token: SeDebugPrivilege 3292 WMIC.exe Token: SeSystemEnvironmentPrivilege 3292 WMIC.exe Token: SeRemoteShutdownPrivilege 3292 WMIC.exe Token: SeUndockPrivilege 3292 WMIC.exe Token: SeManageVolumePrivilege 3292 WMIC.exe Token: 33 3292 WMIC.exe Token: 34 3292 WMIC.exe Token: 35 3292 WMIC.exe Token: 36 3292 WMIC.exe Token: SeIncreaseQuotaPrivilege 3292 WMIC.exe Token: SeSecurityPrivilege 3292 WMIC.exe Token: SeTakeOwnershipPrivilege 3292 WMIC.exe Token: SeLoadDriverPrivilege 3292 WMIC.exe Token: SeSystemProfilePrivilege 3292 WMIC.exe Token: SeSystemtimePrivilege 3292 WMIC.exe Token: SeProfSingleProcessPrivilege 3292 WMIC.exe Token: SeIncBasePriorityPrivilege 3292 WMIC.exe Token: SeCreatePagefilePrivilege 3292 WMIC.exe Token: SeBackupPrivilege 3292 WMIC.exe Token: SeRestorePrivilege 3292 WMIC.exe Token: SeShutdownPrivilege 3292 WMIC.exe Token: SeDebugPrivilege 3292 WMIC.exe Token: SeSystemEnvironmentPrivilege 3292 WMIC.exe Token: SeRemoteShutdownPrivilege 3292 WMIC.exe Token: SeUndockPrivilege 3292 WMIC.exe Token: SeManageVolumePrivilege 3292 WMIC.exe Token: 33 3292 WMIC.exe Token: 34 3292 WMIC.exe Token: 35 3292 WMIC.exe Token: 36 3292 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 2872 ShellExperienceHost.exe 2872 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.execmd.exedescription pid process target process PID 3464 wrote to memory of 764 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 3464 wrote to memory of 764 3464 dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe cmd.exe PID 764 wrote to memory of 3292 764 cmd.exe WMIC.exe PID 764 wrote to memory of 3292 764 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\dbc76355c56a885a1475174fb5325d61b875fd6207ef465cae05617b49463a38.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory