Analysis
-
max time kernel
113s -
max time network
117s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-10-2021 08:42
Static task
static1
Behavioral task
behavioral1
Sample
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe
Resource
win10v20210408
General
-
Target
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe
-
Size
194KB
-
MD5
554c953ea45e18e76f3f9fcbd833dd33
-
SHA1
34fa94ba87ec9011b3c3417e2b3509446508992c
-
SHA256
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f
-
SHA512
3a0e3440efde8599174321fa8eb52b07a2076936ad0a09fd111c52a20bcad49ee050c4b39d7d5adf896cebd31863c1a7cc1b04dfd96fc1a06fa215fb5891b71c
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\SelectExport.crw => C:\Users\Admin\Pictures\SelectExport.crw.ZXQSZ 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File renamed C:\Users\Admin\Pictures\SkipStop.raw => C:\Users\Admin\Pictures\SkipStop.raw.ZXQSZ 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe -
Drops startup file 1 IoCs
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\license.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\pt-BR.pak 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msador28.tlb 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\Comb_field_White@1x.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_ja_4.4.0.v20140623020002.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\THMBNAIL.PNG 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\selector.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\da-dk\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jce.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sk-sk\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hu-hu\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\affDescription.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview-hover.svg 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\locale\az\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_ja.jar 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\THMBNAIL.PNG 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\readme.txt 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exepid process 1832 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe 1832 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4076 vssvc.exe Token: SeRestorePrivilege 4076 vssvc.exe Token: SeAuditPrivilege 4076 vssvc.exe Token: SeIncreaseQuotaPrivilege 828 WMIC.exe Token: SeSecurityPrivilege 828 WMIC.exe Token: SeTakeOwnershipPrivilege 828 WMIC.exe Token: SeLoadDriverPrivilege 828 WMIC.exe Token: SeSystemProfilePrivilege 828 WMIC.exe Token: SeSystemtimePrivilege 828 WMIC.exe Token: SeProfSingleProcessPrivilege 828 WMIC.exe Token: SeIncBasePriorityPrivilege 828 WMIC.exe Token: SeCreatePagefilePrivilege 828 WMIC.exe Token: SeBackupPrivilege 828 WMIC.exe Token: SeRestorePrivilege 828 WMIC.exe Token: SeShutdownPrivilege 828 WMIC.exe Token: SeDebugPrivilege 828 WMIC.exe Token: SeSystemEnvironmentPrivilege 828 WMIC.exe Token: SeRemoteShutdownPrivilege 828 WMIC.exe Token: SeUndockPrivilege 828 WMIC.exe Token: SeManageVolumePrivilege 828 WMIC.exe Token: 33 828 WMIC.exe Token: 34 828 WMIC.exe Token: 35 828 WMIC.exe Token: 36 828 WMIC.exe Token: SeIncreaseQuotaPrivilege 828 WMIC.exe Token: SeSecurityPrivilege 828 WMIC.exe Token: SeTakeOwnershipPrivilege 828 WMIC.exe Token: SeLoadDriverPrivilege 828 WMIC.exe Token: SeSystemProfilePrivilege 828 WMIC.exe Token: SeSystemtimePrivilege 828 WMIC.exe Token: SeProfSingleProcessPrivilege 828 WMIC.exe Token: SeIncBasePriorityPrivilege 828 WMIC.exe Token: SeCreatePagefilePrivilege 828 WMIC.exe Token: SeBackupPrivilege 828 WMIC.exe Token: SeRestorePrivilege 828 WMIC.exe Token: SeShutdownPrivilege 828 WMIC.exe Token: SeDebugPrivilege 828 WMIC.exe Token: SeSystemEnvironmentPrivilege 828 WMIC.exe Token: SeRemoteShutdownPrivilege 828 WMIC.exe Token: SeUndockPrivilege 828 WMIC.exe Token: SeManageVolumePrivilege 828 WMIC.exe Token: 33 828 WMIC.exe Token: 34 828 WMIC.exe Token: 35 828 WMIC.exe Token: 36 828 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.execmd.exedescription pid process target process PID 1832 wrote to memory of 556 1832 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 1832 wrote to memory of 556 1832 675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe cmd.exe PID 556 wrote to memory of 828 556 cmd.exe WMIC.exe PID 556 wrote to memory of 828 556 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\675731ed62f1dfa24300eb41e7431de21aeb876e97093b0353cbad0c02cbe13f.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken