Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 09:47
Static task
static1
Behavioral task
behavioral1
Sample
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe
-
Size
192KB
-
MD5
e6676709305e02828f8925810e7ee7b2
-
SHA1
145505184e63b1656e42cbe1cb7aad7262f35ffe
-
SHA256
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344
-
SHA512
ee99b5dce2f1955c968bf7ee93916dff5c8a3c89fb579416a7adb16be5ea8bf0cae7a12ee7e0baf6bd2ebd3fb10dcc404f111b6f9a39e1c0df184ed10870e7a5
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\ResolveSave.tiff => C:\Users\Admin\Pictures\ResolveSave.tiff.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\RevokeSave.raw => C:\Users\Admin\Pictures\RevokeSave.raw.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\SearchSet.raw => C:\Users\Admin\Pictures\SearchSet.raw.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\SendJoin.tiff f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\UseNew.tiff f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\CompleteDeny.tif => C:\Users\Admin\Pictures\CompleteDeny.tif.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExitTest.tif => C:\Users\Admin\Pictures\ExitTest.tif.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\ResolveSave.tiff f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\UseNew.tiff => C:\Users\Admin\Pictures\UseNew.tiff.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\GetWrite.png => C:\Users\Admin\Pictures\GetWrite.png.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\SendJoin.tiff => C:\Users\Admin\Pictures\SendJoin.tiff.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01575_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01296_.GIF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBSBR.DPV f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Denver f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\VelvetRose.css f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296288.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01160_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\hu\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageScript.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153091.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0252629.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02287_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\LASER.WAV f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME36.CSS f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.XML f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01180_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00458_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297185.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR.HXS f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\MSBuild\Microsoft\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00058_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.XML f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_ON.GIF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00114_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00336_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18229_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ED00172_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALNDR98.POC f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\WHOOSH.WAV f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR32F.GIF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\THEMES.INF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02141_.WMF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exepid process 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1192 vssvc.exe Token: SeRestorePrivilege 1192 vssvc.exe Token: SeAuditPrivilege 1192 vssvc.exe Token: SeIncreaseQuotaPrivilege 1468 WMIC.exe Token: SeSecurityPrivilege 1468 WMIC.exe Token: SeTakeOwnershipPrivilege 1468 WMIC.exe Token: SeLoadDriverPrivilege 1468 WMIC.exe Token: SeSystemProfilePrivilege 1468 WMIC.exe Token: SeSystemtimePrivilege 1468 WMIC.exe Token: SeProfSingleProcessPrivilege 1468 WMIC.exe Token: SeIncBasePriorityPrivilege 1468 WMIC.exe Token: SeCreatePagefilePrivilege 1468 WMIC.exe Token: SeBackupPrivilege 1468 WMIC.exe Token: SeRestorePrivilege 1468 WMIC.exe Token: SeShutdownPrivilege 1468 WMIC.exe Token: SeDebugPrivilege 1468 WMIC.exe Token: SeSystemEnvironmentPrivilege 1468 WMIC.exe Token: SeRemoteShutdownPrivilege 1468 WMIC.exe Token: SeUndockPrivilege 1468 WMIC.exe Token: SeManageVolumePrivilege 1468 WMIC.exe Token: 33 1468 WMIC.exe Token: 34 1468 WMIC.exe Token: 35 1468 WMIC.exe Token: SeIncreaseQuotaPrivilege 1468 WMIC.exe Token: SeSecurityPrivilege 1468 WMIC.exe Token: SeTakeOwnershipPrivilege 1468 WMIC.exe Token: SeLoadDriverPrivilege 1468 WMIC.exe Token: SeSystemProfilePrivilege 1468 WMIC.exe Token: SeSystemtimePrivilege 1468 WMIC.exe Token: SeProfSingleProcessPrivilege 1468 WMIC.exe Token: SeIncBasePriorityPrivilege 1468 WMIC.exe Token: SeCreatePagefilePrivilege 1468 WMIC.exe Token: SeBackupPrivilege 1468 WMIC.exe Token: SeRestorePrivilege 1468 WMIC.exe Token: SeShutdownPrivilege 1468 WMIC.exe Token: SeDebugPrivilege 1468 WMIC.exe Token: SeSystemEnvironmentPrivilege 1468 WMIC.exe Token: SeRemoteShutdownPrivilege 1468 WMIC.exe Token: SeUndockPrivilege 1468 WMIC.exe Token: SeManageVolumePrivilege 1468 WMIC.exe Token: 33 1468 WMIC.exe Token: 34 1468 WMIC.exe Token: 35 1468 WMIC.exe Token: SeIncreaseQuotaPrivilege 1720 WMIC.exe Token: SeSecurityPrivilege 1720 WMIC.exe Token: SeTakeOwnershipPrivilege 1720 WMIC.exe Token: SeLoadDriverPrivilege 1720 WMIC.exe Token: SeSystemProfilePrivilege 1720 WMIC.exe Token: SeSystemtimePrivilege 1720 WMIC.exe Token: SeProfSingleProcessPrivilege 1720 WMIC.exe Token: SeIncBasePriorityPrivilege 1720 WMIC.exe Token: SeCreatePagefilePrivilege 1720 WMIC.exe Token: SeBackupPrivilege 1720 WMIC.exe Token: SeRestorePrivilege 1720 WMIC.exe Token: SeShutdownPrivilege 1720 WMIC.exe Token: SeDebugPrivilege 1720 WMIC.exe Token: SeSystemEnvironmentPrivilege 1720 WMIC.exe Token: SeRemoteShutdownPrivilege 1720 WMIC.exe Token: SeUndockPrivilege 1720 WMIC.exe Token: SeManageVolumePrivilege 1720 WMIC.exe Token: 33 1720 WMIC.exe Token: 34 1720 WMIC.exe Token: 35 1720 WMIC.exe Token: SeIncreaseQuotaPrivilege 1720 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 612 wrote to memory of 1468 612 cmd.exe WMIC.exe PID 612 wrote to memory of 1468 612 cmd.exe WMIC.exe PID 612 wrote to memory of 1468 612 cmd.exe WMIC.exe PID 1920 wrote to memory of 1908 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1908 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1908 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1908 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1908 wrote to memory of 1720 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1720 1908 cmd.exe WMIC.exe PID 1908 wrote to memory of 1720 1908 cmd.exe WMIC.exe PID 1920 wrote to memory of 1688 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1688 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1688 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1688 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1688 wrote to memory of 1676 1688 cmd.exe WMIC.exe PID 1688 wrote to memory of 1676 1688 cmd.exe WMIC.exe PID 1688 wrote to memory of 1676 1688 cmd.exe WMIC.exe PID 1920 wrote to memory of 1620 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1620 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1620 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1620 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1620 wrote to memory of 752 1620 cmd.exe WMIC.exe PID 1620 wrote to memory of 752 1620 cmd.exe WMIC.exe PID 1620 wrote to memory of 752 1620 cmd.exe WMIC.exe PID 1920 wrote to memory of 1204 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1204 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1204 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1204 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1204 wrote to memory of 780 1204 cmd.exe WMIC.exe PID 1204 wrote to memory of 780 1204 cmd.exe WMIC.exe PID 1204 wrote to memory of 780 1204 cmd.exe WMIC.exe PID 1920 wrote to memory of 572 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 572 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 572 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 572 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 572 wrote to memory of 1096 572 cmd.exe WMIC.exe PID 572 wrote to memory of 1096 572 cmd.exe WMIC.exe PID 572 wrote to memory of 1096 572 cmd.exe WMIC.exe PID 1920 wrote to memory of 1932 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1932 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1932 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1932 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1932 wrote to memory of 1856 1932 cmd.exe WMIC.exe PID 1932 wrote to memory of 1856 1932 cmd.exe WMIC.exe PID 1932 wrote to memory of 1856 1932 cmd.exe WMIC.exe PID 1920 wrote to memory of 1140 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1140 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1140 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 1140 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1140 wrote to memory of 1988 1140 cmd.exe WMIC.exe PID 1140 wrote to memory of 1988 1140 cmd.exe WMIC.exe PID 1140 wrote to memory of 1988 1140 cmd.exe WMIC.exe PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 1920 wrote to memory of 612 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 612 wrote to memory of 1816 612 cmd.exe WMIC.exe PID 612 wrote to memory of 1816 612 cmd.exe WMIC.exe PID 612 wrote to memory of 1816 612 cmd.exe WMIC.exe PID 1920 wrote to memory of 1908 1920 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/572-71-0x0000000000000000-mapping.dmp
-
memory/612-61-0x0000000000000000-mapping.dmp
-
memory/612-77-0x0000000000000000-mapping.dmp
-
memory/752-68-0x0000000000000000-mapping.dmp
-
memory/780-70-0x0000000000000000-mapping.dmp
-
memory/1096-72-0x0000000000000000-mapping.dmp
-
memory/1140-75-0x0000000000000000-mapping.dmp
-
memory/1204-69-0x0000000000000000-mapping.dmp
-
memory/1468-62-0x0000000000000000-mapping.dmp
-
memory/1620-67-0x0000000000000000-mapping.dmp
-
memory/1676-66-0x0000000000000000-mapping.dmp
-
memory/1688-65-0x0000000000000000-mapping.dmp
-
memory/1720-64-0x0000000000000000-mapping.dmp
-
memory/1772-82-0x0000000000000000-mapping.dmp
-
memory/1784-81-0x0000000000000000-mapping.dmp
-
memory/1816-78-0x0000000000000000-mapping.dmp
-
memory/1856-74-0x0000000000000000-mapping.dmp
-
memory/1908-79-0x0000000000000000-mapping.dmp
-
memory/1908-63-0x0000000000000000-mapping.dmp
-
memory/1920-60-0x0000000076691000-0x0000000076693000-memory.dmpFilesize
8KB
-
memory/1932-73-0x0000000000000000-mapping.dmp
-
memory/1936-80-0x0000000000000000-mapping.dmp
-
memory/1988-76-0x0000000000000000-mapping.dmp