Analysis
-
max time kernel
116s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:47
Static task
static1
Behavioral task
behavioral1
Sample
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe
-
Size
192KB
-
MD5
e6676709305e02828f8925810e7ee7b2
-
SHA1
145505184e63b1656e42cbe1cb7aad7262f35ffe
-
SHA256
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344
-
SHA512
ee99b5dce2f1955c968bf7ee93916dff5c8a3c89fb579416a7adb16be5ea8bf0cae7a12ee7e0baf6bd2ebd3fb10dcc404f111b6f9a39e1c0df184ed10870e7a5
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\UnprotectGrant.crw => C:\Users\Admin\Pictures\UnprotectGrant.crw.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\PingDisable.tif => C:\Users\Admin\Pictures\PingDisable.tif.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\ProtectJoin.png => C:\Users\Admin\Pictures\ProtectJoin.png.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File renamed C:\Users\Admin\Pictures\SuspendDebug.raw => C:\Users\Admin\Pictures\SuspendDebug.raw.XOOZG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exedescription ioc process File opened for modification C:\Program Files\7-Zip\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_zh_CN.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\ui-strings.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\css\main.css f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\ui-strings.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\Uninstall Information\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder_dark_18.svg f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.jpg f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\da-dk\ui-strings.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lt.pak f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\ui-strings.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ar.pak f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\THMBNAIL.PNG f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-disabled_32.svg f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\SearchEmail.png f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-tool-view.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity@2x.png f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\hyph_en_US.dic f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\custom.lua f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\readme.txt f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Drops file in Windows directory 4 IoCs
Processes:
ShellExperienceHost.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exepid process 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3740 vssvc.exe Token: SeRestorePrivilege 3740 vssvc.exe Token: SeAuditPrivilege 3740 vssvc.exe Token: SeIncreaseQuotaPrivilege 420 WMIC.exe Token: SeSecurityPrivilege 420 WMIC.exe Token: SeTakeOwnershipPrivilege 420 WMIC.exe Token: SeLoadDriverPrivilege 420 WMIC.exe Token: SeSystemProfilePrivilege 420 WMIC.exe Token: SeSystemtimePrivilege 420 WMIC.exe Token: SeProfSingleProcessPrivilege 420 WMIC.exe Token: SeIncBasePriorityPrivilege 420 WMIC.exe Token: SeCreatePagefilePrivilege 420 WMIC.exe Token: SeBackupPrivilege 420 WMIC.exe Token: SeRestorePrivilege 420 WMIC.exe Token: SeShutdownPrivilege 420 WMIC.exe Token: SeDebugPrivilege 420 WMIC.exe Token: SeSystemEnvironmentPrivilege 420 WMIC.exe Token: SeRemoteShutdownPrivilege 420 WMIC.exe Token: SeUndockPrivilege 420 WMIC.exe Token: SeManageVolumePrivilege 420 WMIC.exe Token: 33 420 WMIC.exe Token: 34 420 WMIC.exe Token: 35 420 WMIC.exe Token: 36 420 WMIC.exe Token: SeIncreaseQuotaPrivilege 420 WMIC.exe Token: SeSecurityPrivilege 420 WMIC.exe Token: SeTakeOwnershipPrivilege 420 WMIC.exe Token: SeLoadDriverPrivilege 420 WMIC.exe Token: SeSystemProfilePrivilege 420 WMIC.exe Token: SeSystemtimePrivilege 420 WMIC.exe Token: SeProfSingleProcessPrivilege 420 WMIC.exe Token: SeIncBasePriorityPrivilege 420 WMIC.exe Token: SeCreatePagefilePrivilege 420 WMIC.exe Token: SeBackupPrivilege 420 WMIC.exe Token: SeRestorePrivilege 420 WMIC.exe Token: SeShutdownPrivilege 420 WMIC.exe Token: SeDebugPrivilege 420 WMIC.exe Token: SeSystemEnvironmentPrivilege 420 WMIC.exe Token: SeRemoteShutdownPrivilege 420 WMIC.exe Token: SeUndockPrivilege 420 WMIC.exe Token: SeManageVolumePrivilege 420 WMIC.exe Token: 33 420 WMIC.exe Token: 34 420 WMIC.exe Token: 35 420 WMIC.exe Token: 36 420 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 1108 ShellExperienceHost.exe 1108 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.execmd.exedescription pid process target process PID 2428 wrote to memory of 4080 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 2428 wrote to memory of 4080 2428 f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe cmd.exe PID 4080 wrote to memory of 420 4080 cmd.exe WMIC.exe PID 4080 wrote to memory of 420 4080 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\f54ae59740ae0294ce5c4ddea42aebb5e57f830643337f43a18aa15bb25a7344.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory