Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 09:45
Static task
static1
Behavioral task
behavioral1
Sample
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe
-
Size
192KB
-
MD5
20a0f74349d36d65cb45a7512596848e
-
SHA1
0c3603f4f1e386e7af030e94f24cfa71a27aa4e5
-
SHA256
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685
-
SHA512
cb5508a7de83fcc47974173675f592e707d908d8bbfa54886fb41e95dd23baa1f74f7f2b4a1ab97bf0ab245c26ac65db0e598ecfeb26c21c10bfb1a2478438f8
Malware Config
Extracted
C:\readme.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\WaitSync.tiff e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File renamed C:\Users\Admin\Pictures\WaitSync.tiff => C:\Users\Admin\Pictures\WaitSync.tiff.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\DenyProtect.tiff e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File renamed C:\Users\Admin\Pictures\DenyProtect.tiff => C:\Users\Admin\Pictures\DenyProtect.tiff.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\TraceUnpublish.tiff e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File renamed C:\Users\Admin\Pictures\TraceUnpublish.tiff => C:\Users\Admin\Pictures\TraceUnpublish.tiff.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File renamed C:\Users\Admin\Pictures\UninstallWrite.crw => C:\Users\Admin\Pictures\UninstallWrite.crw.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnpublishRename.crw => C:\Users\Admin\Pictures\UnpublishRename.crw.CECJF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\XLSTART\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-gb\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ul-oob.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\da-dk\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-fr\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\US_export_policy.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\fr-FR\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-focus.svg e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\zh-tw\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ul-oob.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_zh_4.4.0.v20140623020002.jar e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\McePerfCtr.man e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\en-US\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt_get.svg e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-cn\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\readme.txt e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nb-no\ui-strings.js e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\CASCADE.INF e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Drops file in Windows directory 4 IoCs
Processes:
ShellExperienceHost.exesvchost.exesvchost.exedescription ioc process File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exepid process 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3712 vssvc.exe Token: SeRestorePrivilege 3712 vssvc.exe Token: SeAuditPrivilege 3712 vssvc.exe Token: SeIncreaseQuotaPrivilege 3580 WMIC.exe Token: SeSecurityPrivilege 3580 WMIC.exe Token: SeTakeOwnershipPrivilege 3580 WMIC.exe Token: SeLoadDriverPrivilege 3580 WMIC.exe Token: SeSystemProfilePrivilege 3580 WMIC.exe Token: SeSystemtimePrivilege 3580 WMIC.exe Token: SeProfSingleProcessPrivilege 3580 WMIC.exe Token: SeIncBasePriorityPrivilege 3580 WMIC.exe Token: SeCreatePagefilePrivilege 3580 WMIC.exe Token: SeBackupPrivilege 3580 WMIC.exe Token: SeRestorePrivilege 3580 WMIC.exe Token: SeShutdownPrivilege 3580 WMIC.exe Token: SeDebugPrivilege 3580 WMIC.exe Token: SeSystemEnvironmentPrivilege 3580 WMIC.exe Token: SeRemoteShutdownPrivilege 3580 WMIC.exe Token: SeUndockPrivilege 3580 WMIC.exe Token: SeManageVolumePrivilege 3580 WMIC.exe Token: 33 3580 WMIC.exe Token: 34 3580 WMIC.exe Token: 35 3580 WMIC.exe Token: 36 3580 WMIC.exe Token: SeIncreaseQuotaPrivilege 3580 WMIC.exe Token: SeSecurityPrivilege 3580 WMIC.exe Token: SeTakeOwnershipPrivilege 3580 WMIC.exe Token: SeLoadDriverPrivilege 3580 WMIC.exe Token: SeSystemProfilePrivilege 3580 WMIC.exe Token: SeSystemtimePrivilege 3580 WMIC.exe Token: SeProfSingleProcessPrivilege 3580 WMIC.exe Token: SeIncBasePriorityPrivilege 3580 WMIC.exe Token: SeCreatePagefilePrivilege 3580 WMIC.exe Token: SeBackupPrivilege 3580 WMIC.exe Token: SeRestorePrivilege 3580 WMIC.exe Token: SeShutdownPrivilege 3580 WMIC.exe Token: SeDebugPrivilege 3580 WMIC.exe Token: SeSystemEnvironmentPrivilege 3580 WMIC.exe Token: SeRemoteShutdownPrivilege 3580 WMIC.exe Token: SeUndockPrivilege 3580 WMIC.exe Token: SeManageVolumePrivilege 3580 WMIC.exe Token: 33 3580 WMIC.exe Token: 34 3580 WMIC.exe Token: 35 3580 WMIC.exe Token: 36 3580 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 1644 ShellExperienceHost.exe 1644 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.execmd.exedescription pid process target process PID 2492 wrote to memory of 3584 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 2492 wrote to memory of 3584 2492 e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe cmd.exe PID 3584 wrote to memory of 3580 3584 cmd.exe WMIC.exe PID 3584 wrote to memory of 3580 3584 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\e7ce83a1a5163487d86538344c4f37c72a795b07b03a40db7d36ec81a442d685.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3580
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:664
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
PID:712