Analysis
-
max time kernel
100s -
max time network
65s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 09:45
Static task
static1
Behavioral task
behavioral1
Sample
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe
-
Size
192KB
-
MD5
20a0f74349d36d65cb45a7512596848e
-
SHA1
0c3603f4f1e386e7af030e94f24cfa71a27aa4e5
-
SHA256
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685
-
SHA512
cb5508a7de83fcc47974173675f592e707d908d8bbfa54886fb41e95dd23baa1f74f7f2b4a1ab97bf0ab245c26ac65db0e598ecfeb26c21c10bfb1a2478438f8
Malware Config
Extracted
C:\readme.txt
conti
polzarutu1982@protonmail.com
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\NewReset.raw => C:\Users\Admin\Pictures\NewReset.raw.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExitFind.crw => C:\Users\Admin\Pictures\ExitFind.crw.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File renamed C:\Users\Admin\Pictures\ImportDebug.tif => C:\Users\Admin\Pictures\ImportDebug.tif.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 39 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\NU1L7O13\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VNYR844D\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\H18KNA1T\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImageMask.bmp e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01063_.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02198_.GIF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Grid.thmx e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Flow.thmx e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKUPD.CFG e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01750_.GIF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_COL.HXT e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740U.BMP e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.dtd e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01636_.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCH98SP.POC e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR1F.GIF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN110.XML e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5A.BDR e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.INF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\en-US\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMSL.ICO e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199475.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\CET e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\THMBNAIL.PNG e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.ELM e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.SYD e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\docs.crx e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0186002.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LISTBOX.JPG e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240695.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\STOPICON.JPG e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152558.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00372_.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN98.POC e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18185_.WMF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exepid process 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1524 vssvc.exe Token: SeRestorePrivilege 1524 vssvc.exe Token: SeAuditPrivilege 1524 vssvc.exe Token: SeIncreaseQuotaPrivilege 1756 WMIC.exe Token: SeSecurityPrivilege 1756 WMIC.exe Token: SeTakeOwnershipPrivilege 1756 WMIC.exe Token: SeLoadDriverPrivilege 1756 WMIC.exe Token: SeSystemProfilePrivilege 1756 WMIC.exe Token: SeSystemtimePrivilege 1756 WMIC.exe Token: SeProfSingleProcessPrivilege 1756 WMIC.exe Token: SeIncBasePriorityPrivilege 1756 WMIC.exe Token: SeCreatePagefilePrivilege 1756 WMIC.exe Token: SeBackupPrivilege 1756 WMIC.exe Token: SeRestorePrivilege 1756 WMIC.exe Token: SeShutdownPrivilege 1756 WMIC.exe Token: SeDebugPrivilege 1756 WMIC.exe Token: SeSystemEnvironmentPrivilege 1756 WMIC.exe Token: SeRemoteShutdownPrivilege 1756 WMIC.exe Token: SeUndockPrivilege 1756 WMIC.exe Token: SeManageVolumePrivilege 1756 WMIC.exe Token: 33 1756 WMIC.exe Token: 34 1756 WMIC.exe Token: 35 1756 WMIC.exe Token: SeIncreaseQuotaPrivilege 1756 WMIC.exe Token: SeSecurityPrivilege 1756 WMIC.exe Token: SeTakeOwnershipPrivilege 1756 WMIC.exe Token: SeLoadDriverPrivilege 1756 WMIC.exe Token: SeSystemProfilePrivilege 1756 WMIC.exe Token: SeSystemtimePrivilege 1756 WMIC.exe Token: SeProfSingleProcessPrivilege 1756 WMIC.exe Token: SeIncBasePriorityPrivilege 1756 WMIC.exe Token: SeCreatePagefilePrivilege 1756 WMIC.exe Token: SeBackupPrivilege 1756 WMIC.exe Token: SeRestorePrivilege 1756 WMIC.exe Token: SeShutdownPrivilege 1756 WMIC.exe Token: SeDebugPrivilege 1756 WMIC.exe Token: SeSystemEnvironmentPrivilege 1756 WMIC.exe Token: SeRemoteShutdownPrivilege 1756 WMIC.exe Token: SeUndockPrivilege 1756 WMIC.exe Token: SeManageVolumePrivilege 1756 WMIC.exe Token: 33 1756 WMIC.exe Token: 34 1756 WMIC.exe Token: 35 1756 WMIC.exe Token: SeIncreaseQuotaPrivilege 1592 WMIC.exe Token: SeSecurityPrivilege 1592 WMIC.exe Token: SeTakeOwnershipPrivilege 1592 WMIC.exe Token: SeLoadDriverPrivilege 1592 WMIC.exe Token: SeSystemProfilePrivilege 1592 WMIC.exe Token: SeSystemtimePrivilege 1592 WMIC.exe Token: SeProfSingleProcessPrivilege 1592 WMIC.exe Token: SeIncBasePriorityPrivilege 1592 WMIC.exe Token: SeCreatePagefilePrivilege 1592 WMIC.exe Token: SeBackupPrivilege 1592 WMIC.exe Token: SeRestorePrivilege 1592 WMIC.exe Token: SeShutdownPrivilege 1592 WMIC.exe Token: SeDebugPrivilege 1592 WMIC.exe Token: SeSystemEnvironmentPrivilege 1592 WMIC.exe Token: SeRemoteShutdownPrivilege 1592 WMIC.exe Token: SeUndockPrivilege 1592 WMIC.exe Token: SeManageVolumePrivilege 1592 WMIC.exe Token: 33 1592 WMIC.exe Token: 34 1592 WMIC.exe Token: 35 1592 WMIC.exe Token: SeIncreaseQuotaPrivilege 1592 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2016 wrote to memory of 1708 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1708 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1708 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1708 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 1708 wrote to memory of 1756 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 1756 1708 cmd.exe WMIC.exe PID 1708 wrote to memory of 1756 1708 cmd.exe WMIC.exe PID 2016 wrote to memory of 828 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 828 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 828 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 828 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 828 wrote to memory of 1592 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1592 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1592 828 cmd.exe WMIC.exe PID 2016 wrote to memory of 1580 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1580 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1580 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1580 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 1580 wrote to memory of 1700 1580 cmd.exe WMIC.exe PID 1580 wrote to memory of 1700 1580 cmd.exe WMIC.exe PID 1580 wrote to memory of 1700 1580 cmd.exe WMIC.exe PID 2016 wrote to memory of 112 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 112 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 112 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 112 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 112 wrote to memory of 1740 112 cmd.exe WMIC.exe PID 112 wrote to memory of 1740 112 cmd.exe WMIC.exe PID 112 wrote to memory of 1740 112 cmd.exe WMIC.exe PID 2016 wrote to memory of 1160 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1160 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1160 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1160 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 1160 wrote to memory of 2032 1160 cmd.exe WMIC.exe PID 1160 wrote to memory of 2032 1160 cmd.exe WMIC.exe PID 1160 wrote to memory of 2032 1160 cmd.exe WMIC.exe PID 2016 wrote to memory of 1368 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1368 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1368 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1368 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 1368 wrote to memory of 1792 1368 cmd.exe WMIC.exe PID 1368 wrote to memory of 1792 1368 cmd.exe WMIC.exe PID 1368 wrote to memory of 1792 1368 cmd.exe WMIC.exe PID 2016 wrote to memory of 1412 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1412 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1412 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1412 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 1412 wrote to memory of 1324 1412 cmd.exe WMIC.exe PID 1412 wrote to memory of 1324 1412 cmd.exe WMIC.exe PID 1412 wrote to memory of 1324 1412 cmd.exe WMIC.exe PID 2016 wrote to memory of 824 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 824 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 824 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 824 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 824 wrote to memory of 1300 824 cmd.exe WMIC.exe PID 824 wrote to memory of 1300 824 cmd.exe WMIC.exe PID 824 wrote to memory of 1300 824 cmd.exe WMIC.exe PID 2016 wrote to memory of 1552 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1552 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1552 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2016 wrote to memory of 1552 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 1552 wrote to memory of 1616 1552 cmd.exe WMIC.exe PID 1552 wrote to memory of 1616 1552 cmd.exe WMIC.exe PID 1552 wrote to memory of 1616 1552 cmd.exe WMIC.exe PID 2016 wrote to memory of 788 2016 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3EA0DCCD-B68F-4739-8545-1421DB5CBBF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6A4DE33F-EC6D-48D6-B18F-B8C0EB661608}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{674F5ED5-898F-4B38-B442-9717EBC249B0}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56062236-819D-4FFA-9A67-51FD862961CC}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{993FFB36-DB0D-4B0F-AB01-F5535FFFD2FF}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5C93421E-92BF-4841-8F4A-AE5CE989C82C}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9CE7C86-FE5D-4BEA-A3FE-1097D95611CF}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{781F970E-534F-47AA-999D-6ED6D643AB75}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39949E94-CD4C-4CF8-B45A-3F512784587B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AB291DFD-F8B7-48E4-8503-043258A3C021}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{485AA00D-2E8F-43E3-8672-B2EC5EA21273}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/112-66-0x0000000000000000-mapping.dmp
-
memory/788-78-0x0000000000000000-mapping.dmp
-
memory/824-74-0x0000000000000000-mapping.dmp
-
memory/828-62-0x0000000000000000-mapping.dmp
-
memory/932-79-0x0000000000000000-mapping.dmp
-
memory/1160-68-0x0000000000000000-mapping.dmp
-
memory/1300-75-0x0000000000000000-mapping.dmp
-
memory/1324-73-0x0000000000000000-mapping.dmp
-
memory/1368-70-0x0000000000000000-mapping.dmp
-
memory/1412-72-0x0000000000000000-mapping.dmp
-
memory/1552-76-0x0000000000000000-mapping.dmp
-
memory/1580-64-0x0000000000000000-mapping.dmp
-
memory/1592-63-0x0000000000000000-mapping.dmp
-
memory/1616-77-0x0000000000000000-mapping.dmp
-
memory/1700-65-0x0000000000000000-mapping.dmp
-
memory/1708-60-0x0000000000000000-mapping.dmp
-
memory/1740-67-0x0000000000000000-mapping.dmp
-
memory/1756-61-0x0000000000000000-mapping.dmp
-
memory/1792-71-0x0000000000000000-mapping.dmp
-
memory/1824-81-0x0000000000000000-mapping.dmp
-
memory/2016-59-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB
-
memory/2032-69-0x0000000000000000-mapping.dmp
-
memory/2036-80-0x0000000000000000-mapping.dmp