conti | 732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884

General

Target

732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
Size

206KB
MD5

f9234840f07c5cfe75b482275a63f549
SHA1

8fbc27b26c4c582b5764eacf897a89fe74c0a88d
SHA256

732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884
SHA512

d47d3a1fd0555da513c0a768d71b7eb19c9adb0df7a04431e74235a02fc37aa22a23beec3757ff1ce3b4370915ff07f431c1d8e26db3704188c1d9708a583ba6

Score

10^/10

conti ransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- dvTyjJN89zAOzGONw3JF0DDEokfNVuxhJsqkqCL6IRZHU5RJHhTaw9KPZjVh7k3z ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click/

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Modifies extensions of user files 15 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\CheckpointClose.png => C:\Users\Admin\Pictures\CheckpointClose.png.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\EnterRead.tiff => C:\Users\Admin\Pictures\EnterRead.tiff.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\SyncExpand.tif => C:\Users\Admin\Pictures\SyncExpand.tif.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\RestartLimit.tif => C:\Users\Admin\Pictures\RestartLimit.tif.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\RestoreProtect.raw => C:\Users\Admin\Pictures\RestoreProtect.raw.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\EnterRead.tiff	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\LimitCompare.tif => C:\Users\Admin\Pictures\LimitCompare.tif.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\MountRedo.crw => C:\Users\Admin\Pictures\MountRedo.crw.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\MoveUnpublish.crw => C:\Users\Admin\Pictures\MoveUnpublish.crw.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\ReceiveSwitch.raw => C:\Users\Admin\Pictures\ReceiveSwitch.raw.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\InitializeStep.tiff	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Users\Admin\Pictures\TraceRestore.tiff	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\TraceRestore.tiff => C:\Users\Admin\Pictures\TraceRestore.tiff.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\InitializeStep.tiff => C:\Users\Admin\Pictures\InitializeStep.tiff.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File renamed	C:\Users\Admin\Pictures\SendResolve.png => C:\Users\Admin\Pictures\SendResolve.png.QTBHS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe

Drops file in Program Files directory 64 IoCs

Processes:

732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SplashScreen.bmp	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00601_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0098497.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02470U.BMP	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File created	C:\Program Files\Java\jdk1.7.0_80\readme.txt	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\readme.txt	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195428.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE.HXS	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00455_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099174.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107182.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00458_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVHM.POC	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File created	C:\Program Files (x86)\Common Files\System\de-DE\readme.txt	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02431_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01797_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.MMW	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.DPV	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ENGLISH.LNG	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02444_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182946.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0157763.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsink.ax	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\readme.txt	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151061.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285796.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01395_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01744_.GIF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00720_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLOGO.XML	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00130_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107358.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195788.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00116_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jsse.jar	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099179.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00685_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02412K.JPG	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01293_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01041_.WMF	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 1112 WerFault.exe 732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe

pid	pid_target	process	target process
1728	1112	WerFault.exe	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exeWerFault.exe

pid	process
1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
1728	WerFault.exe
1728	WerFault.exe
1728	WerFault.exe
1728	WerFault.exe
1728	WerFault.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1612	vssvc.exe
Token: SeRestorePrivilege	1612	vssvc.exe
Token: SeAuditPrivilege	1612	vssvc.exe
Token: SeIncreaseQuotaPrivilege	772	WMIC.exe
Token: SeSecurityPrivilege	772	WMIC.exe
Token: SeTakeOwnershipPrivilege	772	WMIC.exe
Token: SeLoadDriverPrivilege	772	WMIC.exe
Token: SeSystemProfilePrivilege	772	WMIC.exe
Token: SeSystemtimePrivilege	772	WMIC.exe
Token: SeProfSingleProcessPrivilege	772	WMIC.exe
Token: SeIncBasePriorityPrivilege	772	WMIC.exe
Token: SeCreatePagefilePrivilege	772	WMIC.exe
Token: SeBackupPrivilege	772	WMIC.exe
Token: SeRestorePrivilege	772	WMIC.exe
Token: SeShutdownPrivilege	772	WMIC.exe
Token: SeDebugPrivilege	772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	772	WMIC.exe
Token: SeRemoteShutdownPrivilege	772	WMIC.exe
Token: SeUndockPrivilege	772	WMIC.exe
Token: SeManageVolumePrivilege	772	WMIC.exe
Token: 33	772	WMIC.exe
Token: 34	772	WMIC.exe
Token: 35	772	WMIC.exe
Token: SeIncreaseQuotaPrivilege	772	WMIC.exe
Token: SeSecurityPrivilege	772	WMIC.exe
Token: SeTakeOwnershipPrivilege	772	WMIC.exe
Token: SeLoadDriverPrivilege	772	WMIC.exe
Token: SeSystemProfilePrivilege	772	WMIC.exe
Token: SeSystemtimePrivilege	772	WMIC.exe
Token: SeProfSingleProcessPrivilege	772	WMIC.exe
Token: SeIncBasePriorityPrivilege	772	WMIC.exe
Token: SeCreatePagefilePrivilege	772	WMIC.exe
Token: SeBackupPrivilege	772	WMIC.exe
Token: SeRestorePrivilege	772	WMIC.exe
Token: SeShutdownPrivilege	772	WMIC.exe
Token: SeDebugPrivilege	772	WMIC.exe
Token: SeSystemEnvironmentPrivilege	772	WMIC.exe
Token: SeRemoteShutdownPrivilege	772	WMIC.exe
Token: SeUndockPrivilege	772	WMIC.exe
Token: SeManageVolumePrivilege	772	WMIC.exe
Token: 33	772	WMIC.exe
Token: 34	772	WMIC.exe
Token: 35	772	WMIC.exe
Token: SeIncreaseQuotaPrivilege	888	WMIC.exe
Token: SeSecurityPrivilege	888	WMIC.exe
Token: SeTakeOwnershipPrivilege	888	WMIC.exe
Token: SeLoadDriverPrivilege	888	WMIC.exe
Token: SeSystemProfilePrivilege	888	WMIC.exe
Token: SeSystemtimePrivilege	888	WMIC.exe
Token: SeProfSingleProcessPrivilege	888	WMIC.exe
Token: SeIncBasePriorityPrivilege	888	WMIC.exe
Token: SeCreatePagefilePrivilege	888	WMIC.exe
Token: SeBackupPrivilege	888	WMIC.exe
Token: SeRestorePrivilege	888	WMIC.exe
Token: SeShutdownPrivilege	888	WMIC.exe
Token: SeDebugPrivilege	888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	888	WMIC.exe
Token: SeRemoteShutdownPrivilege	888	WMIC.exe
Token: SeUndockPrivilege	888	WMIC.exe
Token: SeManageVolumePrivilege	888	WMIC.exe
Token: 33	888	WMIC.exe
Token: 34	888	WMIC.exe
Token: 35	888	WMIC.exe
Token: SeIncreaseQuotaPrivilege	888	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1112 wrote to memory of 596	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 596	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 596	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 596	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 596 wrote to memory of 772	596	cmd.exe	WMIC.exe
PID 596 wrote to memory of 772	596	cmd.exe	WMIC.exe
PID 596 wrote to memory of 772	596	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1132	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1132	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1132	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1132	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1132 wrote to memory of 888	1132	cmd.exe	WMIC.exe
PID 1132 wrote to memory of 888	1132	cmd.exe	WMIC.exe
PID 1132 wrote to memory of 888	1132	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1176	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1176	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1176	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1176	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1176 wrote to memory of 1040	1176	cmd.exe	WMIC.exe
PID 1176 wrote to memory of 1040	1176	cmd.exe	WMIC.exe
PID 1176 wrote to memory of 1040	1176	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1812	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1812	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1812	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1812	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1812 wrote to memory of 1164	1812	cmd.exe	WMIC.exe
PID 1812 wrote to memory of 1164	1812	cmd.exe	WMIC.exe
PID 1812 wrote to memory of 1164	1812	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1820	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1820	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1820	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1820	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1820 wrote to memory of 1248	1820	cmd.exe	WMIC.exe
PID 1820 wrote to memory of 1248	1820	cmd.exe	WMIC.exe
PID 1820 wrote to memory of 1248	1820	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 768	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 768	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 768	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 768	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 768 wrote to memory of 1736	768	cmd.exe	WMIC.exe
PID 768 wrote to memory of 1736	768	cmd.exe	WMIC.exe
PID 768 wrote to memory of 1736	768	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1740	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1740	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1740	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 1740	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1740 wrote to memory of 2028	1740	cmd.exe	WMIC.exe
PID 1740 wrote to memory of 2028	1740	cmd.exe	WMIC.exe
PID 1740 wrote to memory of 2028	1740	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 680	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 680	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 680	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 680	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 680 wrote to memory of 1484	680	cmd.exe	WMIC.exe
PID 680 wrote to memory of 1484	680	cmd.exe	WMIC.exe
PID 680 wrote to memory of 1484	680	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 908	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 908	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 908	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 1112 wrote to memory of 908	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe
PID 908 wrote to memory of 1652	908	cmd.exe	WMIC.exe
PID 908 wrote to memory of 1652	908	cmd.exe	WMIC.exe
PID 908 wrote to memory of 1652	908	cmd.exe	WMIC.exe
PID 1112 wrote to memory of 1840	1112	732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\732e207d32fe4296e6cf0b4e874111e551a9490329e662fe42958e08ef3a9884.bin.sample.exe"
1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
3⤵
PID:1040

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
3⤵
PID:1164

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
3⤵
PID:1248

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
3⤵
PID:1736

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
3⤵
PID:2028

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
3⤵
PID:1484

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
3⤵
PID:1652

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
2⤵
PID:1840

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
3⤵
PID:1104

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
2⤵
PID:2004

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
3⤵
PID:1780

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
2⤵
PID:1648

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
3⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1564
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:1728

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/596-55-0x0000000000000000-mapping.dmp

Download
memory/680-69-0x0000000000000000-mapping.dmp

Download
memory/768-65-0x0000000000000000-mapping.dmp

Download
memory/772-56-0x0000000000000000-mapping.dmp

Download
memory/888-58-0x0000000000000000-mapping.dmp

Download
memory/908-71-0x0000000000000000-mapping.dmp

Download
memory/1040-60-0x0000000000000000-mapping.dmp

Download
memory/1104-74-0x0000000000000000-mapping.dmp

Download
memory/1112-54-0x0000000075871000-0x0000000075873000-memory.dmp

Filesize
8KB

Download
memory/1132-57-0x0000000000000000-mapping.dmp

Download
memory/1164-62-0x0000000000000000-mapping.dmp

Download
memory/1176-59-0x0000000000000000-mapping.dmp

Download
memory/1228-78-0x0000000000000000-mapping.dmp

Download
memory/1248-64-0x0000000000000000-mapping.dmp

Download
memory/1484-70-0x0000000000000000-mapping.dmp

Download
memory/1648-77-0x0000000000000000-mapping.dmp

Download
memory/1652-72-0x0000000000000000-mapping.dmp

Download
memory/1728-79-0x0000000000000000-mapping.dmp

Download
memory/1728-80-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1736-66-0x0000000000000000-mapping.dmp

Download
memory/1740-67-0x0000000000000000-mapping.dmp

Download
memory/1780-76-0x0000000000000000-mapping.dmp

Download
memory/1812-61-0x0000000000000000-mapping.dmp

Download
memory/1820-63-0x0000000000000000-mapping.dmp

Download
memory/1840-73-0x0000000000000000-mapping.dmp

Download
memory/2004-75-0x0000000000000000-mapping.dmp

Download
memory/2028-68-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads