Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
05-10-2021 08:42
Static task
static1
Behavioral task
behavioral1
Sample
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe
Resource
win10v20210408
General
-
Target
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe
-
Size
194KB
-
MD5
554c953ea45e18e76f3f9fcbd833dd33
-
SHA1
34fa94ba87ec9011b3c3417e2b3509446508992c
-
SHA256
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f
-
SHA512
3a0e3440efde8599174321fa8eb52b07a2076936ad0a09fd111c52a20bcad49ee050c4b39d7d5adf896cebd31863c1a7cc1b04dfd96fc1a06fa215fb5891b71c
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\MountGet.crw => C:\Users\Admin\Pictures\MountGet.crw.ZXQSZ 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Users\Admin\Pictures\PopReceive.tiff 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File renamed C:\Users\Admin\Pictures\PopReceive.tiff => C:\Users\Admin\Pictures\PopReceive.tiff.ZXQSZ 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File renamed C:\Users\Admin\Pictures\SelectRead.png => C:\Users\Admin\Pictures\SelectRead.png.ZXQSZ 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182888.WMF 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_K_COL.HXK 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IT.XML 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\WPGIMP32.FLT 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\FM20.CHM 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\meta-index 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00289_.WMF 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Pushpin.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GB.XSL 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_ButtonGraphic.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Issue Tracking.gta 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BORDERBB.POC 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07804_.WMF 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\STOPICON.JPG 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7FR.LEX 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\id\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.APL 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\SignedManagedObjects.cer 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01421_.WMF 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSGR3FR.LEX 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePageScript.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02269_.WMF 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.events_3.0.0.draft20060413_v201105210656.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSO0127.ACL 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_ja_4.4.0.v20140623020002.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\blocklist.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exepid process 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1444 vssvc.exe Token: SeRestorePrivilege 1444 vssvc.exe Token: SeAuditPrivilege 1444 vssvc.exe Token: SeIncreaseQuotaPrivilege 572 WMIC.exe Token: SeSecurityPrivilege 572 WMIC.exe Token: SeTakeOwnershipPrivilege 572 WMIC.exe Token: SeLoadDriverPrivilege 572 WMIC.exe Token: SeSystemProfilePrivilege 572 WMIC.exe Token: SeSystemtimePrivilege 572 WMIC.exe Token: SeProfSingleProcessPrivilege 572 WMIC.exe Token: SeIncBasePriorityPrivilege 572 WMIC.exe Token: SeCreatePagefilePrivilege 572 WMIC.exe Token: SeBackupPrivilege 572 WMIC.exe Token: SeRestorePrivilege 572 WMIC.exe Token: SeShutdownPrivilege 572 WMIC.exe Token: SeDebugPrivilege 572 WMIC.exe Token: SeSystemEnvironmentPrivilege 572 WMIC.exe Token: SeRemoteShutdownPrivilege 572 WMIC.exe Token: SeUndockPrivilege 572 WMIC.exe Token: SeManageVolumePrivilege 572 WMIC.exe Token: 33 572 WMIC.exe Token: 34 572 WMIC.exe Token: 35 572 WMIC.exe Token: SeIncreaseQuotaPrivilege 572 WMIC.exe Token: SeSecurityPrivilege 572 WMIC.exe Token: SeTakeOwnershipPrivilege 572 WMIC.exe Token: SeLoadDriverPrivilege 572 WMIC.exe Token: SeSystemProfilePrivilege 572 WMIC.exe Token: SeSystemtimePrivilege 572 WMIC.exe Token: SeProfSingleProcessPrivilege 572 WMIC.exe Token: SeIncBasePriorityPrivilege 572 WMIC.exe Token: SeCreatePagefilePrivilege 572 WMIC.exe Token: SeBackupPrivilege 572 WMIC.exe Token: SeRestorePrivilege 572 WMIC.exe Token: SeShutdownPrivilege 572 WMIC.exe Token: SeDebugPrivilege 572 WMIC.exe Token: SeSystemEnvironmentPrivilege 572 WMIC.exe Token: SeRemoteShutdownPrivilege 572 WMIC.exe Token: SeUndockPrivilege 572 WMIC.exe Token: SeManageVolumePrivilege 572 WMIC.exe Token: 33 572 WMIC.exe Token: 34 572 WMIC.exe Token: 35 572 WMIC.exe Token: SeIncreaseQuotaPrivilege 816 WMIC.exe Token: SeSecurityPrivilege 816 WMIC.exe Token: SeTakeOwnershipPrivilege 816 WMIC.exe Token: SeLoadDriverPrivilege 816 WMIC.exe Token: SeSystemProfilePrivilege 816 WMIC.exe Token: SeSystemtimePrivilege 816 WMIC.exe Token: SeProfSingleProcessPrivilege 816 WMIC.exe Token: SeIncBasePriorityPrivilege 816 WMIC.exe Token: SeCreatePagefilePrivilege 816 WMIC.exe Token: SeBackupPrivilege 816 WMIC.exe Token: SeRestorePrivilege 816 WMIC.exe Token: SeShutdownPrivilege 816 WMIC.exe Token: SeDebugPrivilege 816 WMIC.exe Token: SeSystemEnvironmentPrivilege 816 WMIC.exe Token: SeRemoteShutdownPrivilege 816 WMIC.exe Token: SeUndockPrivilege 816 WMIC.exe Token: SeManageVolumePrivilege 816 WMIC.exe Token: 33 816 WMIC.exe Token: 34 816 WMIC.exe Token: 35 816 WMIC.exe Token: SeIncreaseQuotaPrivilege 816 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1740 wrote to memory of 320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 320 wrote to memory of 572 320 cmd.exe WMIC.exe PID 320 wrote to memory of 572 320 cmd.exe WMIC.exe PID 320 wrote to memory of 572 320 cmd.exe WMIC.exe PID 1740 wrote to memory of 108 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 108 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 108 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 108 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 108 wrote to memory of 816 108 cmd.exe WMIC.exe PID 108 wrote to memory of 816 108 cmd.exe WMIC.exe PID 108 wrote to memory of 816 108 cmd.exe WMIC.exe PID 1740 wrote to memory of 1100 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1100 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1100 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1100 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1100 wrote to memory of 856 1100 cmd.exe WMIC.exe PID 1100 wrote to memory of 856 1100 cmd.exe WMIC.exe PID 1100 wrote to memory of 856 1100 cmd.exe WMIC.exe PID 1740 wrote to memory of 956 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 956 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 956 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 956 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 956 wrote to memory of 1548 956 cmd.exe WMIC.exe PID 956 wrote to memory of 1548 956 cmd.exe WMIC.exe PID 956 wrote to memory of 1548 956 cmd.exe WMIC.exe PID 1740 wrote to memory of 1556 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1556 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1556 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1556 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1556 wrote to memory of 1056 1556 cmd.exe WMIC.exe PID 1556 wrote to memory of 1056 1556 cmd.exe WMIC.exe PID 1556 wrote to memory of 1056 1556 cmd.exe WMIC.exe PID 1740 wrote to memory of 280 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 280 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 280 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 280 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 280 wrote to memory of 1724 280 cmd.exe WMIC.exe PID 280 wrote to memory of 1724 280 cmd.exe WMIC.exe PID 280 wrote to memory of 1724 280 cmd.exe WMIC.exe PID 1740 wrote to memory of 1320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1320 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1320 wrote to memory of 1696 1320 cmd.exe WMIC.exe PID 1320 wrote to memory of 1696 1320 cmd.exe WMIC.exe PID 1320 wrote to memory of 1696 1320 cmd.exe WMIC.exe PID 1740 wrote to memory of 1052 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1052 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1052 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1052 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1052 wrote to memory of 340 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 340 1052 cmd.exe WMIC.exe PID 1052 wrote to memory of 340 1052 cmd.exe WMIC.exe PID 1740 wrote to memory of 1972 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1972 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1972 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1740 wrote to memory of 1972 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1972 wrote to memory of 668 1972 cmd.exe WMIC.exe PID 1972 wrote to memory of 668 1972 cmd.exe WMIC.exe PID 1972 wrote to memory of 668 1972 cmd.exe WMIC.exe PID 1740 wrote to memory of 952 1740 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/108-56-0x0000000000000000-mapping.dmp
-
memory/280-64-0x0000000000000000-mapping.dmp
-
memory/320-54-0x0000000000000000-mapping.dmp
-
memory/340-69-0x0000000000000000-mapping.dmp
-
memory/572-55-0x0000000000000000-mapping.dmp
-
memory/668-71-0x0000000000000000-mapping.dmp
-
memory/816-57-0x0000000000000000-mapping.dmp
-
memory/856-59-0x0000000000000000-mapping.dmp
-
memory/952-72-0x0000000000000000-mapping.dmp
-
memory/956-60-0x0000000000000000-mapping.dmp
-
memory/984-76-0x0000000000000000-mapping.dmp
-
memory/1052-68-0x0000000000000000-mapping.dmp
-
memory/1056-63-0x0000000000000000-mapping.dmp
-
memory/1068-77-0x0000000000000000-mapping.dmp
-
memory/1100-58-0x0000000000000000-mapping.dmp
-
memory/1320-66-0x0000000000000000-mapping.dmp
-
memory/1404-73-0x0000000000000000-mapping.dmp
-
memory/1548-61-0x0000000000000000-mapping.dmp
-
memory/1556-62-0x0000000000000000-mapping.dmp
-
memory/1672-74-0x0000000000000000-mapping.dmp
-
memory/1696-67-0x0000000000000000-mapping.dmp
-
memory/1724-65-0x0000000000000000-mapping.dmp
-
memory/1740-53-0x00000000765A1000-0x00000000765A3000-memory.dmpFilesize
8KB
-
memory/1872-75-0x0000000000000000-mapping.dmp
-
memory/1972-70-0x0000000000000000-mapping.dmp