Analysis
-
max time kernel
81s -
max time network
48s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
30-09-2021 19:48
Static task
static1
Behavioral task
behavioral1
Sample
54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37.dll
Resource
win10v20210408
General
-
Target
54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37.dll
-
Size
356KB
-
MD5
a4893ca94d909ae8a152a8afc1a66523
-
SHA1
cfe5b8b1dba12c328994b2977ef6d82138c406dc
-
SHA256
54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37
-
SHA512
d5b97a444336a8fb2b136c8215e88ce032accce9704c9a7e7006a94c2b967dc032714ac109a0732ca9bd68454c58772bf79f244ecbe6f0952837745951d24540
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 14 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\DisableCompare.tif => C:\Users\Admin\Pictures\DisableCompare.tif.MUYUS rundll32.exe File opened for modification C:\Users\Admin\Pictures\GetApprove.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\OutSend.crw => C:\Users\Admin\Pictures\OutSend.crw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\PingImport.tif => C:\Users\Admin\Pictures\PingImport.tif.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\RevokeOut.tiff => C:\Users\Admin\Pictures\RevokeOut.tiff.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\GetApprove.tiff => C:\Users\Admin\Pictures\GetApprove.tiff.MUYUS rundll32.exe File opened for modification C:\Users\Admin\Pictures\ProtectSelect.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\StopSync.crw => C:\Users\Admin\Pictures\StopSync.crw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\ProtectSelect.tiff => C:\Users\Admin\Pictures\ProtectSelect.tiff.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\SubmitReceive.raw => C:\Users\Admin\Pictures\SubmitReceive.raw.MUYUS rundll32.exe File opened for modification C:\Users\Admin\Pictures\RevokeOut.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\SendCheckpoint.raw => C:\Users\Admin\Pictures\SendCheckpoint.raw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\ShowOpen.raw => C:\Users\Admin\Pictures\ShowOpen.raw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\SkipDebug.png => C:\Users\Admin\Pictures\SkipDebug.png.MUYUS rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Music\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Music\desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini rundll32.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini rundll32.exe File opened for modification C:\Users\Public\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini rundll32.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Links\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Documents\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini rundll32.exe File opened for modification C:\Program Files\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Videos\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\desktop.ini rundll32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00833_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Efate rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0252629.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02120_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\PREVIEW.GIF rundll32.exe File opened for modification C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215070.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00389_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00364_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_ja_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00270_.WMF rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\adojavas.inc rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.INF rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\readme.txt rundll32.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar rundll32.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WWINTL.REST.IDX_DLL rundll32.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLAPPTR.FAE rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_ON.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\macroprogress.gif rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Country.gif rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml rundll32.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\readme.txt rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7B.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECURL.ICO rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml rundll32.exe File created C:\Program Files\Microsoft Games\More Games\en-US\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css rundll32.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341557.JPG rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\OCEAN_01.MID rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0093905.WMF rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14832_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00261_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105328.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00299_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe 1380 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 748 vssvc.exe Token: SeRestorePrivilege 748 vssvc.exe Token: SeAuditPrivilege 748 vssvc.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe Token: SeShutdownPrivilege 1064 WMIC.exe Token: SeDebugPrivilege 1064 WMIC.exe Token: SeSystemEnvironmentPrivilege 1064 WMIC.exe Token: SeRemoteShutdownPrivilege 1064 WMIC.exe Token: SeUndockPrivilege 1064 WMIC.exe Token: SeManageVolumePrivilege 1064 WMIC.exe Token: 33 1064 WMIC.exe Token: 34 1064 WMIC.exe Token: 35 1064 WMIC.exe Token: SeIncreaseQuotaPrivilege 1064 WMIC.exe Token: SeSecurityPrivilege 1064 WMIC.exe Token: SeTakeOwnershipPrivilege 1064 WMIC.exe Token: SeLoadDriverPrivilege 1064 WMIC.exe Token: SeSystemProfilePrivilege 1064 WMIC.exe Token: SeSystemtimePrivilege 1064 WMIC.exe Token: SeProfSingleProcessPrivilege 1064 WMIC.exe Token: SeIncBasePriorityPrivilege 1064 WMIC.exe Token: SeCreatePagefilePrivilege 1064 WMIC.exe Token: SeBackupPrivilege 1064 WMIC.exe Token: SeRestorePrivilege 1064 WMIC.exe Token: SeShutdownPrivilege 1064 WMIC.exe Token: SeDebugPrivilege 1064 WMIC.exe Token: SeSystemEnvironmentPrivilege 1064 WMIC.exe Token: SeRemoteShutdownPrivilege 1064 WMIC.exe Token: SeUndockPrivilege 1064 WMIC.exe Token: SeManageVolumePrivilege 1064 WMIC.exe Token: 33 1064 WMIC.exe Token: 34 1064 WMIC.exe Token: 35 1064 WMIC.exe Token: SeIncreaseQuotaPrivilege 1232 WMIC.exe Token: SeSecurityPrivilege 1232 WMIC.exe Token: SeTakeOwnershipPrivilege 1232 WMIC.exe Token: SeLoadDriverPrivilege 1232 WMIC.exe Token: SeSystemProfilePrivilege 1232 WMIC.exe Token: SeSystemtimePrivilege 1232 WMIC.exe Token: SeProfSingleProcessPrivilege 1232 WMIC.exe Token: SeIncBasePriorityPrivilege 1232 WMIC.exe Token: SeCreatePagefilePrivilege 1232 WMIC.exe Token: SeBackupPrivilege 1232 WMIC.exe Token: SeRestorePrivilege 1232 WMIC.exe Token: SeShutdownPrivilege 1232 WMIC.exe Token: SeDebugPrivilege 1232 WMIC.exe Token: SeSystemEnvironmentPrivilege 1232 WMIC.exe Token: SeRemoteShutdownPrivilege 1232 WMIC.exe Token: SeUndockPrivilege 1232 WMIC.exe Token: SeManageVolumePrivilege 1232 WMIC.exe Token: 33 1232 WMIC.exe Token: 34 1232 WMIC.exe Token: 35 1232 WMIC.exe Token: SeIncreaseQuotaPrivilege 1232 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1336 wrote to memory of 1380 1336 rundll32.exe rundll32.exe PID 1336 wrote to memory of 1380 1336 rundll32.exe rundll32.exe PID 1336 wrote to memory of 1380 1336 rundll32.exe rundll32.exe PID 1336 wrote to memory of 1380 1336 rundll32.exe rundll32.exe PID 1336 wrote to memory of 1380 1336 rundll32.exe rundll32.exe PID 1336 wrote to memory of 1380 1336 rundll32.exe rundll32.exe PID 1336 wrote to memory of 1380 1336 rundll32.exe rundll32.exe PID 1380 wrote to memory of 772 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 772 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 772 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 772 1380 rundll32.exe cmd.exe PID 772 wrote to memory of 1064 772 cmd.exe WMIC.exe PID 772 wrote to memory of 1064 772 cmd.exe WMIC.exe PID 772 wrote to memory of 1064 772 cmd.exe WMIC.exe PID 772 wrote to memory of 1064 772 cmd.exe WMIC.exe PID 1380 wrote to memory of 872 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 872 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 872 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 872 1380 rundll32.exe cmd.exe PID 872 wrote to memory of 1232 872 cmd.exe WMIC.exe PID 872 wrote to memory of 1232 872 cmd.exe WMIC.exe PID 872 wrote to memory of 1232 872 cmd.exe WMIC.exe PID 872 wrote to memory of 1232 872 cmd.exe WMIC.exe PID 1380 wrote to memory of 2044 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 2044 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 2044 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 2044 1380 rundll32.exe cmd.exe PID 2044 wrote to memory of 1660 2044 cmd.exe WMIC.exe PID 2044 wrote to memory of 1660 2044 cmd.exe WMIC.exe PID 2044 wrote to memory of 1660 2044 cmd.exe WMIC.exe PID 2044 wrote to memory of 1660 2044 cmd.exe WMIC.exe PID 1380 wrote to memory of 1144 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1144 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1144 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1144 1380 rundll32.exe cmd.exe PID 1144 wrote to memory of 1580 1144 cmd.exe WMIC.exe PID 1144 wrote to memory of 1580 1144 cmd.exe WMIC.exe PID 1144 wrote to memory of 1580 1144 cmd.exe WMIC.exe PID 1144 wrote to memory of 1580 1144 cmd.exe WMIC.exe PID 1380 wrote to memory of 1464 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1464 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1464 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1464 1380 rundll32.exe cmd.exe PID 1464 wrote to memory of 1376 1464 cmd.exe WMIC.exe PID 1464 wrote to memory of 1376 1464 cmd.exe WMIC.exe PID 1464 wrote to memory of 1376 1464 cmd.exe WMIC.exe PID 1464 wrote to memory of 1376 1464 cmd.exe WMIC.exe PID 1380 wrote to memory of 1304 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1304 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1304 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 1304 1380 rundll32.exe cmd.exe PID 1304 wrote to memory of 1748 1304 cmd.exe WMIC.exe PID 1304 wrote to memory of 1748 1304 cmd.exe WMIC.exe PID 1304 wrote to memory of 1748 1304 cmd.exe WMIC.exe PID 1304 wrote to memory of 1748 1304 cmd.exe WMIC.exe PID 1380 wrote to memory of 844 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 844 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 844 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 844 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 472 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 472 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 472 1380 rundll32.exe cmd.exe PID 1380 wrote to memory of 472 1380 rundll32.exe cmd.exe PID 472 wrote to memory of 832 472 cmd.exe WMIC.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37.dll,#12⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete4⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/300-72-0x0000000000000000-mapping.dmp
-
memory/432-76-0x0000000000000000-mapping.dmp
-
memory/456-73-0x0000000000000000-mapping.dmp
-
memory/472-70-0x0000000000000000-mapping.dmp
-
memory/772-57-0x0000000000000000-mapping.dmp
-
memory/832-71-0x0000000000000000-mapping.dmp
-
memory/844-69-0x0000000000000000-mapping.dmp
-
memory/872-59-0x0000000000000000-mapping.dmp
-
memory/1064-58-0x0000000000000000-mapping.dmp
-
memory/1100-75-0x0000000000000000-mapping.dmp
-
memory/1144-63-0x0000000000000000-mapping.dmp
-
memory/1232-60-0x0000000000000000-mapping.dmp
-
memory/1304-67-0x0000000000000000-mapping.dmp
-
memory/1368-78-0x0000000000000000-mapping.dmp
-
memory/1376-66-0x0000000000000000-mapping.dmp
-
memory/1380-55-0x0000000000190000-0x00000000001DF000-memory.dmpFilesize
316KB
-
memory/1380-53-0x0000000000000000-mapping.dmp
-
memory/1380-56-0x0000000010000000-0x000000001005C000-memory.dmpFilesize
368KB
-
memory/1380-54-0x0000000074C71000-0x0000000074C73000-memory.dmpFilesize
8KB
-
memory/1440-77-0x0000000000000000-mapping.dmp
-
memory/1464-65-0x0000000000000000-mapping.dmp
-
memory/1580-64-0x0000000000000000-mapping.dmp
-
memory/1660-62-0x0000000000000000-mapping.dmp
-
memory/1748-68-0x0000000000000000-mapping.dmp
-
memory/1876-74-0x0000000000000000-mapping.dmp
-
memory/1884-79-0x0000000000000000-mapping.dmp
-
memory/2044-61-0x0000000000000000-mapping.dmp