Analysis
-
max time kernel
151s -
max time network
79s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 20:24
Static task
static1
Behavioral task
behavioral1
Sample
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe
Resource
win10v20210408
General
-
Target
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe
-
Size
185KB
-
MD5
3a3001ecddb08440a659d49e4e29a697
-
SHA1
124d9ce50a4b0dfa0b150b44c77c85cd2589148c
-
SHA256
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5
-
SHA512
5b08e11eded00c94995c7d1d3e3ad195461dbe978618cdc638099dec8d52d39874b48cdfd4798ad82d3f3dc5cfaa4b5196c127c51a77779e20d6558a46f3275f
Malware Config
Extracted
C:\readme.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 16 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\EnterComplete.tiff 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\EnterComplete.tiff => C:\Users\Admin\Pictures\EnterComplete.tiff.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\OpenProtect.tiff => C:\Users\Admin\Pictures\OpenProtect.tiff.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\RegisterSplit.png => C:\Users\Admin\Pictures\RegisterSplit.png.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\GetSubmit.crw => C:\Users\Admin\Pictures\GetSubmit.crw.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\InstallCompress.png => C:\Users\Admin\Pictures\InstallCompress.png.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\OpenProtect.tiff 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\WatchUninstall.tiff 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\DisableEnable.tiff => C:\Users\Admin\Pictures\DisableEnable.tiff.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\EditSet.tiff 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\OpenResume.png => C:\Users\Admin\Pictures\OpenResume.png.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\UseDebug.crw => C:\Users\Admin\Pictures\UseDebug.crw.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\AssertStop.raw => C:\Users\Admin\Pictures\AssertStop.raw.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\DisableEnable.tiff 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\EditSet.tiff => C:\Users\Admin\Pictures\EditSet.tiff.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File renamed C:\Users\Admin\Pictures\WatchUninstall.tiff => C:\Users\Admin\Pictures\WatchUninstall.tiff.PASWV 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exedescription ioc process File opened for modification C:\Users\Admin\Desktop\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Music\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Music\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Videos\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Links\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Users\Public\Documents\desktop.ini 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Drops file in Program Files directory 64 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.INF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter_18.svg 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\sysinfo 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Common Files\System\msadc\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jfxrt.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightRegular.ttf 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setEmbeddedCP 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-execution.xml 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\an\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\METCONV.TXT 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\SATIN.INF 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-ui.jar 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\en_GB\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\Client\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\VSTOFiles.cat 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe File created C:\Program Files\Microsoft Office\root\vfs\System\readme.txt 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exepid process 516 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe 516 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1016 vssvc.exe Token: SeRestorePrivilege 1016 vssvc.exe Token: SeAuditPrivilege 1016 vssvc.exe Token: SeIncreaseQuotaPrivilege 1464 WMIC.exe Token: SeSecurityPrivilege 1464 WMIC.exe Token: SeTakeOwnershipPrivilege 1464 WMIC.exe Token: SeLoadDriverPrivilege 1464 WMIC.exe Token: SeSystemProfilePrivilege 1464 WMIC.exe Token: SeSystemtimePrivilege 1464 WMIC.exe Token: SeProfSingleProcessPrivilege 1464 WMIC.exe Token: SeIncBasePriorityPrivilege 1464 WMIC.exe Token: SeCreatePagefilePrivilege 1464 WMIC.exe Token: SeBackupPrivilege 1464 WMIC.exe Token: SeRestorePrivilege 1464 WMIC.exe Token: SeShutdownPrivilege 1464 WMIC.exe Token: SeDebugPrivilege 1464 WMIC.exe Token: SeSystemEnvironmentPrivilege 1464 WMIC.exe Token: SeRemoteShutdownPrivilege 1464 WMIC.exe Token: SeUndockPrivilege 1464 WMIC.exe Token: SeManageVolumePrivilege 1464 WMIC.exe Token: 33 1464 WMIC.exe Token: 34 1464 WMIC.exe Token: 35 1464 WMIC.exe Token: 36 1464 WMIC.exe Token: SeIncreaseQuotaPrivilege 1464 WMIC.exe Token: SeSecurityPrivilege 1464 WMIC.exe Token: SeTakeOwnershipPrivilege 1464 WMIC.exe Token: SeLoadDriverPrivilege 1464 WMIC.exe Token: SeSystemProfilePrivilege 1464 WMIC.exe Token: SeSystemtimePrivilege 1464 WMIC.exe Token: SeProfSingleProcessPrivilege 1464 WMIC.exe Token: SeIncBasePriorityPrivilege 1464 WMIC.exe Token: SeCreatePagefilePrivilege 1464 WMIC.exe Token: SeBackupPrivilege 1464 WMIC.exe Token: SeRestorePrivilege 1464 WMIC.exe Token: SeShutdownPrivilege 1464 WMIC.exe Token: SeDebugPrivilege 1464 WMIC.exe Token: SeSystemEnvironmentPrivilege 1464 WMIC.exe Token: SeRemoteShutdownPrivilege 1464 WMIC.exe Token: SeUndockPrivilege 1464 WMIC.exe Token: SeManageVolumePrivilege 1464 WMIC.exe Token: 33 1464 WMIC.exe Token: 34 1464 WMIC.exe Token: 35 1464 WMIC.exe Token: 36 1464 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.execmd.exedescription pid process target process PID 516 wrote to memory of 1328 516 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 516 wrote to memory of 1328 516 64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe cmd.exe PID 1328 wrote to memory of 1464 1328 cmd.exe WMIC.exe PID 1328 wrote to memory of 1464 1328 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\64f1a2e5f52292fba8f64a851c466d558f1607cac783f30015f6df9e0dbce1c5.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken