conti | e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7

General

Target

e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Size

1.6MB
MD5

520d488564da102f5482fcfdcdbd266a
SHA1

45deee8360e5af17ca04f4bc0fd2c52ae92eb9f0
SHA256

e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7
SHA512

e2c4f46dcf40b8f03bc9fbe0f0cecf933d2825788b0e9f270e7e7ae8a60174d1b7fc778870aa7ce7ba5cb464f28cc5842d043fc93535921749d186e414f51906

Score

10^/10

conti ransomware spyware stealer

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- gufrazxanJ7rgxARuOTCYpFqVJnyoZuShdALs3PjCnANuWY0pSpb7JFDTaK78q9g ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\RemoveSearch.crw => C:\Users\Admin\Pictures\RemoveSearch.crw.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File renamed	C:\Users\Admin\Pictures\RenameExport.png => C:\Users\Admin\Pictures\RenameExport.png.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File renamed	C:\Users\Admin\Pictures\UnprotectRequest.raw => C:\Users\Admin\Pictures\UnprotectRequest.raw.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File renamed	C:\Users\Admin\Pictures\CompareResolve.tiff => C:\Users\Admin\Pictures\CompareResolve.tiff.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromGroup.crw => C:\Users\Admin\Pictures\ConvertFromGroup.crw.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File renamed	C:\Users\Admin\Pictures\NewDeny.tif => C:\Users\Admin\Pictures\NewDeny.tif.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File renamed	C:\Users\Admin\Pictures\ClearUse.crw => C:\Users\Admin\Pictures\ClearUse.crw.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Users\Admin\Pictures\CompareResolve.tiff	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File renamed	C:\Users\Admin\Pictures\WriteSuspend.png => C:\Users\Admin\Pictures\WriteSuspend.png.LCODG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287018.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00330_.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105398.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.XML	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\MENUS.JS	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado28.tlb	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\handler.reg	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\skin.dtd	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152436.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0197983.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00411_.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\readme.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\NETWORK.INF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\PREVIEW.GIF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\gmail.crx	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\JNGLE_01.MID	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285360.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBAR.DPV	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\tr.pak	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.VN.XML	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_F_COL.HXK	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCARD.XML	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\readme.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\readme.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187835.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART7.BDR	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\readme.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103850.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_K_COL.HXK	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONFLICT.ICO	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151045.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21423_.GIF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME51.CSS	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_off.gif	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00693_.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105276.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215718.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLY98SP.POC	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\readme.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\readme.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03731_.WMF	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe

pid process

1080 e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe

pid	process
1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1716	vssvc.exe
Token: SeRestorePrivilege	1716	vssvc.exe
Token: SeAuditPrivilege	1716	vssvc.exe
Token: SeIncreaseQuotaPrivilege	624	WMIC.exe
Token: SeSecurityPrivilege	624	WMIC.exe
Token: SeTakeOwnershipPrivilege	624	WMIC.exe
Token: SeLoadDriverPrivilege	624	WMIC.exe
Token: SeSystemProfilePrivilege	624	WMIC.exe
Token: SeSystemtimePrivilege	624	WMIC.exe
Token: SeProfSingleProcessPrivilege	624	WMIC.exe
Token: SeIncBasePriorityPrivilege	624	WMIC.exe
Token: SeCreatePagefilePrivilege	624	WMIC.exe
Token: SeBackupPrivilege	624	WMIC.exe
Token: SeRestorePrivilege	624	WMIC.exe
Token: SeShutdownPrivilege	624	WMIC.exe
Token: SeDebugPrivilege	624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	624	WMIC.exe
Token: SeRemoteShutdownPrivilege	624	WMIC.exe
Token: SeUndockPrivilege	624	WMIC.exe
Token: SeManageVolumePrivilege	624	WMIC.exe
Token: 33	624	WMIC.exe
Token: 34	624	WMIC.exe
Token: 35	624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	624	WMIC.exe
Token: SeSecurityPrivilege	624	WMIC.exe
Token: SeTakeOwnershipPrivilege	624	WMIC.exe
Token: SeLoadDriverPrivilege	624	WMIC.exe
Token: SeSystemProfilePrivilege	624	WMIC.exe
Token: SeSystemtimePrivilege	624	WMIC.exe
Token: SeProfSingleProcessPrivilege	624	WMIC.exe
Token: SeIncBasePriorityPrivilege	624	WMIC.exe
Token: SeCreatePagefilePrivilege	624	WMIC.exe
Token: SeBackupPrivilege	624	WMIC.exe
Token: SeRestorePrivilege	624	WMIC.exe
Token: SeShutdownPrivilege	624	WMIC.exe
Token: SeDebugPrivilege	624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	624	WMIC.exe
Token: SeRemoteShutdownPrivilege	624	WMIC.exe
Token: SeUndockPrivilege	624	WMIC.exe
Token: SeManageVolumePrivilege	624	WMIC.exe
Token: 33	624	WMIC.exe
Token: 34	624	WMIC.exe
Token: 35	624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1704	WMIC.exe
Token: SeSecurityPrivilege	1704	WMIC.exe
Token: SeTakeOwnershipPrivilege	1704	WMIC.exe
Token: SeLoadDriverPrivilege	1704	WMIC.exe
Token: SeSystemProfilePrivilege	1704	WMIC.exe
Token: SeSystemtimePrivilege	1704	WMIC.exe
Token: SeProfSingleProcessPrivilege	1704	WMIC.exe
Token: SeIncBasePriorityPrivilege	1704	WMIC.exe
Token: SeCreatePagefilePrivilege	1704	WMIC.exe
Token: SeBackupPrivilege	1704	WMIC.exe
Token: SeRestorePrivilege	1704	WMIC.exe
Token: SeShutdownPrivilege	1704	WMIC.exe
Token: SeDebugPrivilege	1704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1704	WMIC.exe
Token: SeRemoteShutdownPrivilege	1704	WMIC.exe
Token: SeUndockPrivilege	1704	WMIC.exe
Token: SeManageVolumePrivilege	1704	WMIC.exe
Token: 33	1704	WMIC.exe
Token: 34	1704	WMIC.exe
Token: 35	1704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1704	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1080 wrote to memory of 1852	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1852	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1852	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1852	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1852 wrote to memory of 624	1852	cmd.exe	WMIC.exe
PID 1852 wrote to memory of 624	1852	cmd.exe	WMIC.exe
PID 1852 wrote to memory of 624	1852	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 1656	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1656	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1656	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1656	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1656 wrote to memory of 1704	1656	cmd.exe	WMIC.exe
PID 1656 wrote to memory of 1704	1656	cmd.exe	WMIC.exe
PID 1656 wrote to memory of 1704	1656	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 944	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 944	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 944	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 944	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 944 wrote to memory of 596	944	cmd.exe	WMIC.exe
PID 944 wrote to memory of 596	944	cmd.exe	WMIC.exe
PID 944 wrote to memory of 596	944	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 1484	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1484	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1484	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1484	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1484 wrote to memory of 1208	1484	cmd.exe	WMIC.exe
PID 1484 wrote to memory of 1208	1484	cmd.exe	WMIC.exe
PID 1484 wrote to memory of 1208	1484	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 1712	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1712	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1712	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1712	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1712 wrote to memory of 1912	1712	cmd.exe	WMIC.exe
PID 1712 wrote to memory of 1912	1712	cmd.exe	WMIC.exe
PID 1712 wrote to memory of 1912	1712	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 1860	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1860	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1860	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1860	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1860 wrote to memory of 1780	1860	cmd.exe	WMIC.exe
PID 1860 wrote to memory of 1780	1860	cmd.exe	WMIC.exe
PID 1860 wrote to memory of 1780	1860	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 1596	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1596	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1596	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1596	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1596 wrote to memory of 1540	1596	cmd.exe	WMIC.exe
PID 1596 wrote to memory of 1540	1596	cmd.exe	WMIC.exe
PID 1596 wrote to memory of 1540	1596	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 1856	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1856	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1856	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 1856	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1856 wrote to memory of 624	1856	cmd.exe	WMIC.exe
PID 1856 wrote to memory of 624	1856	cmd.exe	WMIC.exe
PID 1856 wrote to memory of 624	1856	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 660	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 660	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 660	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 1080 wrote to memory of 660	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe
PID 660 wrote to memory of 1704	660	cmd.exe	WMIC.exe
PID 660 wrote to memory of 1704	660	cmd.exe	WMIC.exe
PID 660 wrote to memory of 1704	660	cmd.exe	WMIC.exe
PID 1080 wrote to memory of 472	1080	e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
"C:\Users\Admin\AppData\Local\Temp\e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe"
1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
3⤵
PID:596

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
3⤵
PID:1208

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
3⤵
PID:1912

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
3⤵
PID:1780

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
3⤵
PID:1540

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
3⤵
PID:624

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
3⤵
PID:1704

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
2⤵
PID:472

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
3⤵
PID:1096

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
2⤵
PID:1568

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
3⤵
PID:616

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
2⤵
PID:1556

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
3⤵
PID:320

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-79-0x0000000000000000-mapping.dmp

Download
memory/472-74-0x0000000000000000-mapping.dmp

Download
memory/596-61-0x0000000000000000-mapping.dmp

Download
memory/616-77-0x0000000000000000-mapping.dmp

Download
memory/624-57-0x0000000000000000-mapping.dmp

Download
memory/624-71-0x0000000000000000-mapping.dmp

Download
memory/660-72-0x0000000000000000-mapping.dmp

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download
memory/1080-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1080-55-0x0000000000740000-0x0000000000B50000-memory.dmp

Filesize
4.1MB

Download
memory/1096-75-0x0000000000000000-mapping.dmp

Download
memory/1208-63-0x0000000000000000-mapping.dmp

Download
memory/1484-62-0x0000000000000000-mapping.dmp

Download
memory/1540-69-0x0000000000000000-mapping.dmp

Download
memory/1556-78-0x0000000000000000-mapping.dmp

Download
memory/1568-76-0x0000000000000000-mapping.dmp

Download
memory/1596-68-0x0000000000000000-mapping.dmp

Download
memory/1656-58-0x0000000000000000-mapping.dmp

Download
memory/1704-59-0x0000000000000000-mapping.dmp

Download
memory/1704-73-0x0000000000000000-mapping.dmp

Download
memory/1712-64-0x0000000000000000-mapping.dmp

Download
memory/1780-67-0x0000000000000000-mapping.dmp

Download
memory/1852-56-0x0000000000000000-mapping.dmp

Download
memory/1856-70-0x0000000000000000-mapping.dmp

Download
memory/1860-66-0x0000000000000000-mapping.dmp

Download
memory/1912-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads