Analysis
-
max time kernel
76s -
max time network
50s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 20:17
Static task
static1
Behavioral task
behavioral1
Sample
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe
-
Size
185KB
-
MD5
1ac77c173fba7dd1475e84c50be35767
-
SHA1
3fd475ff9035742ff45d8a85c05e0c3fca453326
-
SHA256
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c
-
SHA512
e02ad3865e5790c17636f661f2a2aaab2ce5dd3efb78cb3402604fbd8cd058714fdba6dd78071c2710e99d2944f6607cba3545d0ca252fbdda4878d0a017f90f
Malware Config
Extracted
C:\R3ADM3.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\CopySkip.png => C:\Users\Admin\Pictures\CopySkip.png.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\ExitExport.tif => C:\Users\Admin\Pictures\ExitExport.tif.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\PopInitialize.tiff 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\PopInitialize.tiff => C:\Users\Admin\Pictures\PopInitialize.tiff.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\RequestClear.tif => C:\Users\Admin\Pictures\RequestClear.tif.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153508.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199423.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\STUBBY1.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PACBELL.NET.XML 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belem 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103262.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN044.XML 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBAD.XML 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\BLUECALM.ELM 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\THMBNAIL.PNG 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.xml 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Common Files\System\ado\de-DE\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOML.ICO 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\GRIPMASK.BMP 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\DVD Maker\de-DE\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152876.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16ImagesMask.bmp 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoBeta.png 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Windows Portable Devices 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Verve.eftx 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEML.ICO 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ChessMCE.png 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153514.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148798.JPG 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21303_.GIF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\sentinel 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01139_.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC.HXS 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Common Files\System\de-DE\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apex.thmx 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01168_.WMF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFNOT.CFG 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21527_.GIF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exepid process 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1620 vssvc.exe Token: SeRestorePrivilege 1620 vssvc.exe Token: SeAuditPrivilege 1620 vssvc.exe Token: SeIncreaseQuotaPrivilege 580 WMIC.exe Token: SeSecurityPrivilege 580 WMIC.exe Token: SeTakeOwnershipPrivilege 580 WMIC.exe Token: SeLoadDriverPrivilege 580 WMIC.exe Token: SeSystemProfilePrivilege 580 WMIC.exe Token: SeSystemtimePrivilege 580 WMIC.exe Token: SeProfSingleProcessPrivilege 580 WMIC.exe Token: SeIncBasePriorityPrivilege 580 WMIC.exe Token: SeCreatePagefilePrivilege 580 WMIC.exe Token: SeBackupPrivilege 580 WMIC.exe Token: SeRestorePrivilege 580 WMIC.exe Token: SeShutdownPrivilege 580 WMIC.exe Token: SeDebugPrivilege 580 WMIC.exe Token: SeSystemEnvironmentPrivilege 580 WMIC.exe Token: SeRemoteShutdownPrivilege 580 WMIC.exe Token: SeUndockPrivilege 580 WMIC.exe Token: SeManageVolumePrivilege 580 WMIC.exe Token: 33 580 WMIC.exe Token: 34 580 WMIC.exe Token: 35 580 WMIC.exe Token: SeIncreaseQuotaPrivilege 580 WMIC.exe Token: SeSecurityPrivilege 580 WMIC.exe Token: SeTakeOwnershipPrivilege 580 WMIC.exe Token: SeLoadDriverPrivilege 580 WMIC.exe Token: SeSystemProfilePrivilege 580 WMIC.exe Token: SeSystemtimePrivilege 580 WMIC.exe Token: SeProfSingleProcessPrivilege 580 WMIC.exe Token: SeIncBasePriorityPrivilege 580 WMIC.exe Token: SeCreatePagefilePrivilege 580 WMIC.exe Token: SeBackupPrivilege 580 WMIC.exe Token: SeRestorePrivilege 580 WMIC.exe Token: SeShutdownPrivilege 580 WMIC.exe Token: SeDebugPrivilege 580 WMIC.exe Token: SeSystemEnvironmentPrivilege 580 WMIC.exe Token: SeRemoteShutdownPrivilege 580 WMIC.exe Token: SeUndockPrivilege 580 WMIC.exe Token: SeManageVolumePrivilege 580 WMIC.exe Token: 33 580 WMIC.exe Token: 34 580 WMIC.exe Token: 35 580 WMIC.exe Token: SeIncreaseQuotaPrivilege 1804 WMIC.exe Token: SeSecurityPrivilege 1804 WMIC.exe Token: SeTakeOwnershipPrivilege 1804 WMIC.exe Token: SeLoadDriverPrivilege 1804 WMIC.exe Token: SeSystemProfilePrivilege 1804 WMIC.exe Token: SeSystemtimePrivilege 1804 WMIC.exe Token: SeProfSingleProcessPrivilege 1804 WMIC.exe Token: SeIncBasePriorityPrivilege 1804 WMIC.exe Token: SeCreatePagefilePrivilege 1804 WMIC.exe Token: SeBackupPrivilege 1804 WMIC.exe Token: SeRestorePrivilege 1804 WMIC.exe Token: SeShutdownPrivilege 1804 WMIC.exe Token: SeDebugPrivilege 1804 WMIC.exe Token: SeSystemEnvironmentPrivilege 1804 WMIC.exe Token: SeRemoteShutdownPrivilege 1804 WMIC.exe Token: SeUndockPrivilege 1804 WMIC.exe Token: SeManageVolumePrivilege 1804 WMIC.exe Token: 33 1804 WMIC.exe Token: 34 1804 WMIC.exe Token: 35 1804 WMIC.exe Token: SeIncreaseQuotaPrivilege 1804 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1556 wrote to memory of 368 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 368 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 368 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 368 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 368 wrote to memory of 580 368 cmd.exe WMIC.exe PID 368 wrote to memory of 580 368 cmd.exe WMIC.exe PID 368 wrote to memory of 580 368 cmd.exe WMIC.exe PID 1556 wrote to memory of 1652 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1652 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1652 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1652 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1652 wrote to memory of 1804 1652 cmd.exe WMIC.exe PID 1652 wrote to memory of 1804 1652 cmd.exe WMIC.exe PID 1652 wrote to memory of 1804 1652 cmd.exe WMIC.exe PID 1556 wrote to memory of 1724 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1724 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1724 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1724 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1724 wrote to memory of 1996 1724 cmd.exe WMIC.exe PID 1724 wrote to memory of 1996 1724 cmd.exe WMIC.exe PID 1724 wrote to memory of 1996 1724 cmd.exe WMIC.exe PID 1556 wrote to memory of 1732 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1732 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1732 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1732 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1732 wrote to memory of 1116 1732 cmd.exe WMIC.exe PID 1732 wrote to memory of 1116 1732 cmd.exe WMIC.exe PID 1732 wrote to memory of 1116 1732 cmd.exe WMIC.exe PID 1556 wrote to memory of 1716 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1716 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1716 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1716 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1716 wrote to memory of 1424 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 1424 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 1424 1716 cmd.exe WMIC.exe PID 1556 wrote to memory of 1540 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1540 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1540 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1540 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1540 wrote to memory of 1592 1540 cmd.exe WMIC.exe PID 1540 wrote to memory of 1592 1540 cmd.exe WMIC.exe PID 1540 wrote to memory of 1592 1540 cmd.exe WMIC.exe PID 1556 wrote to memory of 1608 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1608 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1608 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1608 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1608 wrote to memory of 1496 1608 cmd.exe WMIC.exe PID 1608 wrote to memory of 1496 1608 cmd.exe WMIC.exe PID 1608 wrote to memory of 1496 1608 cmd.exe WMIC.exe PID 1556 wrote to memory of 528 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 528 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 528 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 528 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 528 wrote to memory of 1444 528 cmd.exe WMIC.exe PID 528 wrote to memory of 1444 528 cmd.exe WMIC.exe PID 528 wrote to memory of 1444 528 cmd.exe WMIC.exe PID 1556 wrote to memory of 1448 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1448 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1448 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1448 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 1448 wrote to memory of 316 1448 cmd.exe WMIC.exe PID 1448 wrote to memory of 316 1448 cmd.exe WMIC.exe PID 1448 wrote to memory of 316 1448 cmd.exe WMIC.exe PID 1556 wrote to memory of 1972 1556 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-72-0x0000000000000000-mapping.dmp
-
memory/368-55-0x0000000000000000-mapping.dmp
-
memory/432-74-0x0000000000000000-mapping.dmp
-
memory/528-69-0x0000000000000000-mapping.dmp
-
memory/580-56-0x0000000000000000-mapping.dmp
-
memory/1116-62-0x0000000000000000-mapping.dmp
-
memory/1168-76-0x0000000000000000-mapping.dmp
-
memory/1424-64-0x0000000000000000-mapping.dmp
-
memory/1444-70-0x0000000000000000-mapping.dmp
-
memory/1448-71-0x0000000000000000-mapping.dmp
-
memory/1496-68-0x0000000000000000-mapping.dmp
-
memory/1540-65-0x0000000000000000-mapping.dmp
-
memory/1552-78-0x0000000000000000-mapping.dmp
-
memory/1556-54-0x00000000757B1000-0x00000000757B3000-memory.dmpFilesize
8KB
-
memory/1592-66-0x0000000000000000-mapping.dmp
-
memory/1608-67-0x0000000000000000-mapping.dmp
-
memory/1628-77-0x0000000000000000-mapping.dmp
-
memory/1652-57-0x0000000000000000-mapping.dmp
-
memory/1716-63-0x0000000000000000-mapping.dmp
-
memory/1724-59-0x0000000000000000-mapping.dmp
-
memory/1732-61-0x0000000000000000-mapping.dmp
-
memory/1804-58-0x0000000000000000-mapping.dmp
-
memory/1808-75-0x0000000000000000-mapping.dmp
-
memory/1972-73-0x0000000000000000-mapping.dmp
-
memory/1996-60-0x0000000000000000-mapping.dmp