Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-09-2021 20:17
Static task
static1
Behavioral task
behavioral1
Sample
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe
Resource
win10-en-20210920
General
-
Target
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe
-
Size
185KB
-
MD5
1ac77c173fba7dd1475e84c50be35767
-
SHA1
3fd475ff9035742ff45d8a85c05e0c3fca453326
-
SHA256
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c
-
SHA512
e02ad3865e5790c17636f661f2a2aaab2ce5dd3efb78cb3402604fbd8cd058714fdba6dd78071c2710e99d2944f6607cba3545d0ca252fbdda4878d0a017f90f
Malware Config
Extracted
C:\R3ADM3.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\SearchResume.tif => C:\Users\Admin\Pictures\SearchResume.tif.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\UnblockFormat.raw => C:\Users\Admin\Pictures\UnblockFormat.raw.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\WaitUnpublish.tif => C:\Users\Admin\Pictures\WaitUnpublish.tif.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\ClearSwitch.crw => C:\Users\Admin\Pictures\ClearSwitch.crw.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\DisableResolve.tiff 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\DisableResolve.tiff => C:\Users\Admin\Pictures\DisableResolve.tiff.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\ReadPop.crw => C:\Users\Admin\Pictures\ReadPop.crw.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResetUnregister.raw => C:\Users\Admin\Pictures\ResetUnregister.raw.GQQNX 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 32 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\lua\meta\art\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fi-fi\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-72x72-precomposed.png 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\uk-ua\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\nb-no\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\splash@2x.gif 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\th_get.svg 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\selector.js 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.htm 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_radio_selected_18.svg 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\preloaded_data.pb 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\1036\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ru-ru\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_cn_135x40.svg 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nothumbnail_34.svg 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\co\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\sv\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\SONORA.INF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-default_32.svg 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\ui-strings.js 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach_5.5.0.165303.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ko-kr\ui-strings.js 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\COMPASS.INF 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\css\main.css 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\warning_2x.png 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_2x.gif 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\css\R3ADM3.txt 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen.svg 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Drops file in Windows directory 3 IoCs
Processes:
ShellExperienceHost.exesvchost.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\1195458082.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2690874625.pri ShellExperienceHost.exe File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exepid process 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2768 vssvc.exe Token: SeRestorePrivilege 2768 vssvc.exe Token: SeAuditPrivilege 2768 vssvc.exe Token: SeIncreaseQuotaPrivilege 4080 WMIC.exe Token: SeSecurityPrivilege 4080 WMIC.exe Token: SeTakeOwnershipPrivilege 4080 WMIC.exe Token: SeLoadDriverPrivilege 4080 WMIC.exe Token: SeSystemProfilePrivilege 4080 WMIC.exe Token: SeSystemtimePrivilege 4080 WMIC.exe Token: SeProfSingleProcessPrivilege 4080 WMIC.exe Token: SeIncBasePriorityPrivilege 4080 WMIC.exe Token: SeCreatePagefilePrivilege 4080 WMIC.exe Token: SeBackupPrivilege 4080 WMIC.exe Token: SeRestorePrivilege 4080 WMIC.exe Token: SeShutdownPrivilege 4080 WMIC.exe Token: SeDebugPrivilege 4080 WMIC.exe Token: SeSystemEnvironmentPrivilege 4080 WMIC.exe Token: SeRemoteShutdownPrivilege 4080 WMIC.exe Token: SeUndockPrivilege 4080 WMIC.exe Token: SeManageVolumePrivilege 4080 WMIC.exe Token: 33 4080 WMIC.exe Token: 34 4080 WMIC.exe Token: 35 4080 WMIC.exe Token: 36 4080 WMIC.exe Token: SeIncreaseQuotaPrivilege 4080 WMIC.exe Token: SeSecurityPrivilege 4080 WMIC.exe Token: SeTakeOwnershipPrivilege 4080 WMIC.exe Token: SeLoadDriverPrivilege 4080 WMIC.exe Token: SeSystemProfilePrivilege 4080 WMIC.exe Token: SeSystemtimePrivilege 4080 WMIC.exe Token: SeProfSingleProcessPrivilege 4080 WMIC.exe Token: SeIncBasePriorityPrivilege 4080 WMIC.exe Token: SeCreatePagefilePrivilege 4080 WMIC.exe Token: SeBackupPrivilege 4080 WMIC.exe Token: SeRestorePrivilege 4080 WMIC.exe Token: SeShutdownPrivilege 4080 WMIC.exe Token: SeDebugPrivilege 4080 WMIC.exe Token: SeSystemEnvironmentPrivilege 4080 WMIC.exe Token: SeRemoteShutdownPrivilege 4080 WMIC.exe Token: SeUndockPrivilege 4080 WMIC.exe Token: SeManageVolumePrivilege 4080 WMIC.exe Token: 33 4080 WMIC.exe Token: 34 4080 WMIC.exe Token: 35 4080 WMIC.exe Token: 36 4080 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ShellExperienceHost.exepid process 600 ShellExperienceHost.exe 600 ShellExperienceHost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.execmd.exedescription pid process target process PID 2176 wrote to memory of 2668 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 2176 wrote to memory of 2668 2176 3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe cmd.exe PID 2668 wrote to memory of 4080 2668 cmd.exe WMIC.exe PID 2668 wrote to memory of 4080 2668 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\3402d9d20bc4622a87c2533484fb98889a5a85bf3191192faf4ef8431f7a4b9c.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3E78C1-16F5-45C2-8C51-8B602BF398FB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2268-117-0x000001FD53C40000-0x000001FD53C50000-memory.dmpFilesize
64KB
-
memory/2268-118-0x000001FD53CB0000-0x000001FD53CC0000-memory.dmpFilesize
64KB
-
memory/2268-119-0x000001FD569D0000-0x000001FD569D1000-memory.dmpFilesize
4KB
-
memory/2668-115-0x0000000000000000-mapping.dmp
-
memory/4080-116-0x0000000000000000-mapping.dmp