Analysis
-
max time kernel
150s -
max time network
39s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-09-2021 20:24
Static task
static1
Behavioral task
behavioral1
Sample
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe
Resource
win10v20210408
General
-
Target
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe
-
Size
185KB
-
MD5
3a3001ecddb08440a659d49e4e29a697
-
SHA1
124d9ce50a4b0dfa0b150b44c77c85cd2589148c
-
SHA256
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5
-
SHA512
5b08e11eded00c94995c7d1d3e3ad195461dbe978618cdc638099dec8d52d39874b48cdfd4798ad82d3f3dc5cfaa4b5196c127c51a77779e20d6558a46f3275f
Malware Config
Extracted
C:\readme.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\LimitEnter.png => C:\Users\Admin\Pictures\LimitEnter.png.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\MergeExpand.tiff 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\MergeExpand.tiff => C:\Users\Admin\Pictures\MergeExpand.tiff.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\OutWatch.crw => C:\Users\Admin\Pictures\OutWatch.crw.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\ResumePublish.raw => C:\Users\Admin\Pictures\ResumePublish.raw.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\TraceJoin.png => C:\Users\Admin\Pictures\TraceJoin.png.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\InitializeWatch.png => C:\Users\Admin\Pictures\InitializeWatch.png.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\OpenStart.tif => C:\Users\Admin\Pictures\OpenStart.tif.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\RestoreNew.raw => C:\Users\Admin\Pictures\RestoreNew.raw.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\SplitSkip.tiff 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\SplitSkip.tiff => C:\Users\Admin\Pictures\SplitSkip.tiff.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\SplitUnlock.tif => C:\Users\Admin\Pictures\SplitUnlock.tif.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Links\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exedescription ioc process File created C:\Program Files\VideoLAN\VLC\lua\sd\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293844.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME17.CSS 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WNTER_01.MID 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4F.GIF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_COL.HXT 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14677_.GIF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POSTITS.ICO 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\NETWORK.ELM 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CROATIAN.TXT 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\DELIMR.FAE 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.WPG 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292286.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CLICK.WAV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Windows Sidebar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado21.tlb 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\PASSWORD.JPG 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\blocklist.xml 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen.css 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157177.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198372.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZFORM.DPV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Mozilla Firefox\uninstall\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\cs\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Excel.en-us\SETUP.XML 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105348.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\WSS.ICO 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICCAP98.POC 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_200_percent.pak 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\CANYON.ELM 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.APL 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exepid process 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1712 vssvc.exe Token: SeRestorePrivilege 1712 vssvc.exe Token: SeAuditPrivilege 1712 vssvc.exe Token: SeIncreaseQuotaPrivilege 524 WMIC.exe Token: SeSecurityPrivilege 524 WMIC.exe Token: SeTakeOwnershipPrivilege 524 WMIC.exe Token: SeLoadDriverPrivilege 524 WMIC.exe Token: SeSystemProfilePrivilege 524 WMIC.exe Token: SeSystemtimePrivilege 524 WMIC.exe Token: SeProfSingleProcessPrivilege 524 WMIC.exe Token: SeIncBasePriorityPrivilege 524 WMIC.exe Token: SeCreatePagefilePrivilege 524 WMIC.exe Token: SeBackupPrivilege 524 WMIC.exe Token: SeRestorePrivilege 524 WMIC.exe Token: SeShutdownPrivilege 524 WMIC.exe Token: SeDebugPrivilege 524 WMIC.exe Token: SeSystemEnvironmentPrivilege 524 WMIC.exe Token: SeRemoteShutdownPrivilege 524 WMIC.exe Token: SeUndockPrivilege 524 WMIC.exe Token: SeManageVolumePrivilege 524 WMIC.exe Token: 33 524 WMIC.exe Token: 34 524 WMIC.exe Token: 35 524 WMIC.exe Token: SeIncreaseQuotaPrivilege 524 WMIC.exe Token: SeSecurityPrivilege 524 WMIC.exe Token: SeTakeOwnershipPrivilege 524 WMIC.exe Token: SeLoadDriverPrivilege 524 WMIC.exe Token: SeSystemProfilePrivilege 524 WMIC.exe Token: SeSystemtimePrivilege 524 WMIC.exe Token: SeProfSingleProcessPrivilege 524 WMIC.exe Token: SeIncBasePriorityPrivilege 524 WMIC.exe Token: SeCreatePagefilePrivilege 524 WMIC.exe Token: SeBackupPrivilege 524 WMIC.exe Token: SeRestorePrivilege 524 WMIC.exe Token: SeShutdownPrivilege 524 WMIC.exe Token: SeDebugPrivilege 524 WMIC.exe Token: SeSystemEnvironmentPrivilege 524 WMIC.exe Token: SeRemoteShutdownPrivilege 524 WMIC.exe Token: SeUndockPrivilege 524 WMIC.exe Token: SeManageVolumePrivilege 524 WMIC.exe Token: 33 524 WMIC.exe Token: 34 524 WMIC.exe Token: 35 524 WMIC.exe Token: SeIncreaseQuotaPrivilege 1120 WMIC.exe Token: SeSecurityPrivilege 1120 WMIC.exe Token: SeTakeOwnershipPrivilege 1120 WMIC.exe Token: SeLoadDriverPrivilege 1120 WMIC.exe Token: SeSystemProfilePrivilege 1120 WMIC.exe Token: SeSystemtimePrivilege 1120 WMIC.exe Token: SeProfSingleProcessPrivilege 1120 WMIC.exe Token: SeIncBasePriorityPrivilege 1120 WMIC.exe Token: SeCreatePagefilePrivilege 1120 WMIC.exe Token: SeBackupPrivilege 1120 WMIC.exe Token: SeRestorePrivilege 1120 WMIC.exe Token: SeShutdownPrivilege 1120 WMIC.exe Token: SeDebugPrivilege 1120 WMIC.exe Token: SeSystemEnvironmentPrivilege 1120 WMIC.exe Token: SeRemoteShutdownPrivilege 1120 WMIC.exe Token: SeUndockPrivilege 1120 WMIC.exe Token: SeManageVolumePrivilege 1120 WMIC.exe Token: 33 1120 WMIC.exe Token: 34 1120 WMIC.exe Token: 35 1120 WMIC.exe Token: SeIncreaseQuotaPrivilege 1120 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1728 wrote to memory of 524 1728 cmd.exe WMIC.exe PID 1728 wrote to memory of 524 1728 cmd.exe WMIC.exe PID 1728 wrote to memory of 524 1728 cmd.exe WMIC.exe PID 1696 wrote to memory of 1612 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1612 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1612 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1612 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1612 wrote to memory of 1120 1612 cmd.exe WMIC.exe PID 1612 wrote to memory of 1120 1612 cmd.exe WMIC.exe PID 1612 wrote to memory of 1120 1612 cmd.exe WMIC.exe PID 1696 wrote to memory of 1064 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1064 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1064 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1064 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1064 wrote to memory of 1112 1064 cmd.exe WMIC.exe PID 1064 wrote to memory of 1112 1064 cmd.exe WMIC.exe PID 1064 wrote to memory of 1112 1064 cmd.exe WMIC.exe PID 1696 wrote to memory of 828 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 828 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 828 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 828 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 828 wrote to memory of 1580 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1580 828 cmd.exe WMIC.exe PID 828 wrote to memory of 1580 828 cmd.exe WMIC.exe PID 1696 wrote to memory of 1504 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1504 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1504 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1504 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1504 wrote to memory of 1476 1504 cmd.exe WMIC.exe PID 1504 wrote to memory of 1476 1504 cmd.exe WMIC.exe PID 1504 wrote to memory of 1476 1504 cmd.exe WMIC.exe PID 1696 wrote to memory of 1244 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1244 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1244 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1244 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1244 wrote to memory of 2044 1244 cmd.exe WMIC.exe PID 1244 wrote to memory of 2044 1244 cmd.exe WMIC.exe PID 1244 wrote to memory of 2044 1244 cmd.exe WMIC.exe PID 1696 wrote to memory of 1748 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1748 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1748 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1748 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1748 wrote to memory of 1212 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1212 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1212 1748 cmd.exe WMIC.exe PID 1696 wrote to memory of 1596 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1596 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1596 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1596 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1596 wrote to memory of 540 1596 cmd.exe WMIC.exe PID 1596 wrote to memory of 540 1596 cmd.exe WMIC.exe PID 1596 wrote to memory of 540 1596 cmd.exe WMIC.exe PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1696 wrote to memory of 1728 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1728 wrote to memory of 1896 1728 cmd.exe WMIC.exe PID 1728 wrote to memory of 1896 1728 cmd.exe WMIC.exe PID 1728 wrote to memory of 1896 1728 cmd.exe WMIC.exe PID 1696 wrote to memory of 1644 1696 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-55-0x0000000000000000-mapping.dmp
-
memory/540-69-0x0000000000000000-mapping.dmp
-
memory/768-73-0x0000000000000000-mapping.dmp
-
memory/828-60-0x0000000000000000-mapping.dmp
-
memory/1064-58-0x0000000000000000-mapping.dmp
-
memory/1064-74-0x0000000000000000-mapping.dmp
-
memory/1112-59-0x0000000000000000-mapping.dmp
-
memory/1120-57-0x0000000000000000-mapping.dmp
-
memory/1168-75-0x0000000000000000-mapping.dmp
-
memory/1212-67-0x0000000000000000-mapping.dmp
-
memory/1244-64-0x0000000000000000-mapping.dmp
-
memory/1476-63-0x0000000000000000-mapping.dmp
-
memory/1504-62-0x0000000000000000-mapping.dmp
-
memory/1524-77-0x0000000000000000-mapping.dmp
-
memory/1580-61-0x0000000000000000-mapping.dmp
-
memory/1596-68-0x0000000000000000-mapping.dmp
-
memory/1604-76-0x0000000000000000-mapping.dmp
-
memory/1612-56-0x0000000000000000-mapping.dmp
-
memory/1644-72-0x0000000000000000-mapping.dmp
-
memory/1696-53-0x00000000767F1000-0x00000000767F3000-memory.dmpFilesize
8KB
-
memory/1728-54-0x0000000000000000-mapping.dmp
-
memory/1728-70-0x0000000000000000-mapping.dmp
-
memory/1748-66-0x0000000000000000-mapping.dmp
-
memory/1896-71-0x0000000000000000-mapping.dmp
-
memory/2044-65-0x0000000000000000-mapping.dmp