Overview
overview
10Static
static
e7969800b4...c7.exe
windows7_x64
10e7969800b4...c7.exe
windows7_x64
10e7969800b4...c7.exe
windows7_x64
10e7969800b4...c7.exe
windows11_x64
10e7969800b4...c7.exe
windows10_x64
10e7969800b4...c7.exe
windows10_x64
10e7969800b4...c7.exe
windows10_x64
10e7969800b4...c7.exe
windows10_x64
10Analysis
-
max time kernel
115s -
max time network
104s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-10-2021 11:35
Static task
static1
Behavioral task
behavioral1
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win7-ja-20210920
Behavioral task
behavioral2
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win7v20210408
Behavioral task
behavioral3
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win7-de-20210920
Behavioral task
behavioral4
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win11
Behavioral task
behavioral5
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win10-ja-20210920
Behavioral task
behavioral7
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win10-en-20210920
Behavioral task
behavioral8
Sample
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
Resource
win10-de-20210920
General
-
Target
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe
-
Size
1.6MB
-
MD5
520d488564da102f5482fcfdcdbd266a
-
SHA1
45deee8360e5af17ca04f4bc0fd2c52ae92eb9f0
-
SHA256
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7
-
SHA512
e2c4f46dcf40b8f03bc9fbe0f0cecf933d2825788b0e9f270e7e7ae8a60174d1b7fc778870aa7ce7ba5cb464f28cc5842d043fc93535921749d186e414f51906
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\GroupUnregister.tiff e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\GroupUnregister.tiff => C:\Users\Admin\Pictures\GroupUnregister.tiff.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\RestoreDisconnect.crw => C:\Users\Admin\Pictures\RestoreDisconnect.crw.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\ConnectOut.png => C:\Users\Admin\Pictures\ConnectOut.png.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Users\Admin\Pictures\CloseBlock.tiff e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\CloseBlock.tiff => C:\Users\Admin\Pictures\CloseBlock.tiff.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\LimitSend.raw => C:\Users\Admin\Pictures\LimitSend.raw.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\StopPing.raw => C:\Users\Admin\Pictures\StopPing.raw.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\UnblockDebug.raw => C:\Users\Admin\Pictures\UnblockDebug.raw.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File renamed C:\Users\Admin\Pictures\CheckpointRename.raw => C:\Users\Admin\Pictures\CheckpointRename.raw.LCODG e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe -
Drops startup file 1 IoCs
Processes:
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbytools.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\TrackedSend.aapp e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\boot_ja.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\SY______.PFM e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-80.png e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNI.TTF e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\HAMMER.WAV e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tr.gif e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\tools.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-execution.xml e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\charsets.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_de.properties e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\br.gif e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File created C:\Program Files\Microsoft Office\root\vfs\readme.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Content.xml e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exepid process 652 e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe 652 e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 684 vssvc.exe Token: SeRestorePrivilege 684 vssvc.exe Token: SeAuditPrivilege 684 vssvc.exe Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe Token: SeSecurityPrivilege 1588 WMIC.exe Token: SeTakeOwnershipPrivilege 1588 WMIC.exe Token: SeLoadDriverPrivilege 1588 WMIC.exe Token: SeSystemProfilePrivilege 1588 WMIC.exe Token: SeSystemtimePrivilege 1588 WMIC.exe Token: SeProfSingleProcessPrivilege 1588 WMIC.exe Token: SeIncBasePriorityPrivilege 1588 WMIC.exe Token: SeCreatePagefilePrivilege 1588 WMIC.exe Token: SeBackupPrivilege 1588 WMIC.exe Token: SeRestorePrivilege 1588 WMIC.exe Token: SeShutdownPrivilege 1588 WMIC.exe Token: SeDebugPrivilege 1588 WMIC.exe Token: SeSystemEnvironmentPrivilege 1588 WMIC.exe Token: SeRemoteShutdownPrivilege 1588 WMIC.exe Token: SeUndockPrivilege 1588 WMIC.exe Token: SeManageVolumePrivilege 1588 WMIC.exe Token: 33 1588 WMIC.exe Token: 34 1588 WMIC.exe Token: 35 1588 WMIC.exe Token: 36 1588 WMIC.exe Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe Token: SeSecurityPrivilege 1588 WMIC.exe Token: SeTakeOwnershipPrivilege 1588 WMIC.exe Token: SeLoadDriverPrivilege 1588 WMIC.exe Token: SeSystemProfilePrivilege 1588 WMIC.exe Token: SeSystemtimePrivilege 1588 WMIC.exe Token: SeProfSingleProcessPrivilege 1588 WMIC.exe Token: SeIncBasePriorityPrivilege 1588 WMIC.exe Token: SeCreatePagefilePrivilege 1588 WMIC.exe Token: SeBackupPrivilege 1588 WMIC.exe Token: SeRestorePrivilege 1588 WMIC.exe Token: SeShutdownPrivilege 1588 WMIC.exe Token: SeDebugPrivilege 1588 WMIC.exe Token: SeSystemEnvironmentPrivilege 1588 WMIC.exe Token: SeRemoteShutdownPrivilege 1588 WMIC.exe Token: SeUndockPrivilege 1588 WMIC.exe Token: SeManageVolumePrivilege 1588 WMIC.exe Token: 33 1588 WMIC.exe Token: 34 1588 WMIC.exe Token: 35 1588 WMIC.exe Token: 36 1588 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.execmd.exedescription pid process target process PID 652 wrote to memory of 1404 652 e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe cmd.exe PID 652 wrote to memory of 1404 652 e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe cmd.exe PID 1404 wrote to memory of 1588 1404 cmd.exe WMIC.exe PID 1404 wrote to memory of 1588 1404 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe"C:\Users\Admin\AppData\Local\Temp\e7969800b4ea77a3719a6ba3127bd561a439323d75f6d61e22e5c64b316768c7.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{493E2A7D-D35C-4823-8312-DB6A87B45E66}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken