Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
25-10-2021 04:58
Static task
static1
Behavioral task
behavioral1
Sample
rw.dll
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
rw.dll
Resource
win10-en-20211014
General
-
Target
rw.dll
-
Size
356KB
-
MD5
a4893ca94d909ae8a152a8afc1a66523
-
SHA1
cfe5b8b1dba12c328994b2977ef6d82138c406dc
-
SHA256
54f3ad16acb12eb0c69afc3dee0c9354a8a1477e590ce223ebe2845de8470d37
-
SHA512
d5b97a444336a8fb2b136c8215e88ce032accce9704c9a7e7006a94c2b967dc032714ac109a0732ca9bd68454c58772bf79f244ecbe6f0952837745951d24540
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rundll32.exedescription ioc process File renamed C:\Users\Admin\Pictures\ApproveSearch.tiff => C:\Users\Admin\Pictures\ApproveSearch.tiff.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\CheckpointOpen.crw => C:\Users\Admin\Pictures\CheckpointOpen.crw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\ConvertFromWrite.raw => C:\Users\Admin\Pictures\ConvertFromWrite.raw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\RenameRedo.png => C:\Users\Admin\Pictures\RenameRedo.png.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\SelectUnprotect.raw => C:\Users\Admin\Pictures\SelectUnprotect.raw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\UnprotectResolve.raw => C:\Users\Admin\Pictures\UnprotectResolve.raw.MUYUS rundll32.exe File renamed C:\Users\Admin\Pictures\UpdateEdit.crw => C:\Users\Admin\Pictures\UpdateEdit.crw.MUYUS rundll32.exe File opened for modification C:\Users\Admin\Pictures\ApproveSearch.tiff rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Links\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Music\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Videos\desktop.ini rundll32.exe File opened for modification C:\Users\Public\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini rundll32.exe File opened for modification C:\Program Files\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JPBNSXHB\desktop.ini rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6TGGRK3W\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\Y8SPHBTY\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Music\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MHZZT4MQ\desktop.ini rundll32.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini rundll32.exe File opened for modification C:\Program Files (x86)\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini rundll32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini rundll32.exe File opened for modification C:\Users\Public\Documents\desktop.ini rundll32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212953.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02755U.BMP rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PNCTUATE.POC rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Curacao rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote-PipelineConfig.xml rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18255_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14868_.GIF rundll32.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212685.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0090386.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_K_COL.HXK rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL083.XML rundll32.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR45B.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL026.XML rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Yakutat rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18200_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar rundll32.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\readme.txt rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107148.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLOGO.DPV rundll32.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Syowa rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01191_.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02386_.WMF rundll32.exe File created C:\Program Files\Microsoft Games\Hearts\fr-FR\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04332_.WMF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy.jar rundll32.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\readme.txt rundll32.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\readme.txt rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145879.JPG rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01840_.GIF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172193.WMF rundll32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ACCESS12.ACC rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\ms.pak rundll32.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\readme.txt rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid process 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe 772 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 108 vssvc.exe Token: SeRestorePrivilege 108 vssvc.exe Token: SeAuditPrivilege 108 vssvc.exe Token: SeIncreaseQuotaPrivilege 1080 WMIC.exe Token: SeSecurityPrivilege 1080 WMIC.exe Token: SeTakeOwnershipPrivilege 1080 WMIC.exe Token: SeLoadDriverPrivilege 1080 WMIC.exe Token: SeSystemProfilePrivilege 1080 WMIC.exe Token: SeSystemtimePrivilege 1080 WMIC.exe Token: SeProfSingleProcessPrivilege 1080 WMIC.exe Token: SeIncBasePriorityPrivilege 1080 WMIC.exe Token: SeCreatePagefilePrivilege 1080 WMIC.exe Token: SeBackupPrivilege 1080 WMIC.exe Token: SeRestorePrivilege 1080 WMIC.exe Token: SeShutdownPrivilege 1080 WMIC.exe Token: SeDebugPrivilege 1080 WMIC.exe Token: SeSystemEnvironmentPrivilege 1080 WMIC.exe Token: SeRemoteShutdownPrivilege 1080 WMIC.exe Token: SeUndockPrivilege 1080 WMIC.exe Token: SeManageVolumePrivilege 1080 WMIC.exe Token: 33 1080 WMIC.exe Token: 34 1080 WMIC.exe Token: 35 1080 WMIC.exe Token: SeIncreaseQuotaPrivilege 1080 WMIC.exe Token: SeSecurityPrivilege 1080 WMIC.exe Token: SeTakeOwnershipPrivilege 1080 WMIC.exe Token: SeLoadDriverPrivilege 1080 WMIC.exe Token: SeSystemProfilePrivilege 1080 WMIC.exe Token: SeSystemtimePrivilege 1080 WMIC.exe Token: SeProfSingleProcessPrivilege 1080 WMIC.exe Token: SeIncBasePriorityPrivilege 1080 WMIC.exe Token: SeCreatePagefilePrivilege 1080 WMIC.exe Token: SeBackupPrivilege 1080 WMIC.exe Token: SeRestorePrivilege 1080 WMIC.exe Token: SeShutdownPrivilege 1080 WMIC.exe Token: SeDebugPrivilege 1080 WMIC.exe Token: SeSystemEnvironmentPrivilege 1080 WMIC.exe Token: SeRemoteShutdownPrivilege 1080 WMIC.exe Token: SeUndockPrivilege 1080 WMIC.exe Token: SeManageVolumePrivilege 1080 WMIC.exe Token: 33 1080 WMIC.exe Token: 34 1080 WMIC.exe Token: 35 1080 WMIC.exe Token: SeIncreaseQuotaPrivilege 1940 WMIC.exe Token: SeSecurityPrivilege 1940 WMIC.exe Token: SeTakeOwnershipPrivilege 1940 WMIC.exe Token: SeLoadDriverPrivilege 1940 WMIC.exe Token: SeSystemProfilePrivilege 1940 WMIC.exe Token: SeSystemtimePrivilege 1940 WMIC.exe Token: SeProfSingleProcessPrivilege 1940 WMIC.exe Token: SeIncBasePriorityPrivilege 1940 WMIC.exe Token: SeCreatePagefilePrivilege 1940 WMIC.exe Token: SeBackupPrivilege 1940 WMIC.exe Token: SeRestorePrivilege 1940 WMIC.exe Token: SeShutdownPrivilege 1940 WMIC.exe Token: SeDebugPrivilege 1940 WMIC.exe Token: SeSystemEnvironmentPrivilege 1940 WMIC.exe Token: SeRemoteShutdownPrivilege 1940 WMIC.exe Token: SeUndockPrivilege 1940 WMIC.exe Token: SeManageVolumePrivilege 1940 WMIC.exe Token: 33 1940 WMIC.exe Token: 34 1940 WMIC.exe Token: 35 1940 WMIC.exe Token: SeIncreaseQuotaPrivilege 1940 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 332 wrote to memory of 772 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 772 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 772 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 772 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 772 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 772 332 rundll32.exe rundll32.exe PID 332 wrote to memory of 772 332 rundll32.exe rundll32.exe PID 772 wrote to memory of 1556 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1556 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1556 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1556 772 rundll32.exe cmd.exe PID 1556 wrote to memory of 1080 1556 cmd.exe WMIC.exe PID 1556 wrote to memory of 1080 1556 cmd.exe WMIC.exe PID 1556 wrote to memory of 1080 1556 cmd.exe WMIC.exe PID 1556 wrote to memory of 1080 1556 cmd.exe WMIC.exe PID 772 wrote to memory of 852 772 rundll32.exe cmd.exe PID 772 wrote to memory of 852 772 rundll32.exe cmd.exe PID 772 wrote to memory of 852 772 rundll32.exe cmd.exe PID 772 wrote to memory of 852 772 rundll32.exe cmd.exe PID 852 wrote to memory of 1940 852 cmd.exe WMIC.exe PID 852 wrote to memory of 1940 852 cmd.exe WMIC.exe PID 852 wrote to memory of 1940 852 cmd.exe WMIC.exe PID 852 wrote to memory of 1940 852 cmd.exe WMIC.exe PID 772 wrote to memory of 2008 772 rundll32.exe cmd.exe PID 772 wrote to memory of 2008 772 rundll32.exe cmd.exe PID 772 wrote to memory of 2008 772 rundll32.exe cmd.exe PID 772 wrote to memory of 2008 772 rundll32.exe cmd.exe PID 2008 wrote to memory of 1768 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1768 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1768 2008 cmd.exe WMIC.exe PID 2008 wrote to memory of 1768 2008 cmd.exe WMIC.exe PID 772 wrote to memory of 1736 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1736 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1736 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1736 772 rundll32.exe cmd.exe PID 1736 wrote to memory of 1512 1736 cmd.exe WMIC.exe PID 1736 wrote to memory of 1512 1736 cmd.exe WMIC.exe PID 1736 wrote to memory of 1512 1736 cmd.exe WMIC.exe PID 1736 wrote to memory of 1512 1736 cmd.exe WMIC.exe PID 772 wrote to memory of 1948 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1948 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1948 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1948 772 rundll32.exe cmd.exe PID 1948 wrote to memory of 884 1948 cmd.exe WMIC.exe PID 1948 wrote to memory of 884 1948 cmd.exe WMIC.exe PID 1948 wrote to memory of 884 1948 cmd.exe WMIC.exe PID 1948 wrote to memory of 884 1948 cmd.exe WMIC.exe PID 772 wrote to memory of 1996 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1996 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1996 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1996 772 rundll32.exe cmd.exe PID 1996 wrote to memory of 1196 1996 cmd.exe WMIC.exe PID 1996 wrote to memory of 1196 1996 cmd.exe WMIC.exe PID 1996 wrote to memory of 1196 1996 cmd.exe WMIC.exe PID 1996 wrote to memory of 1196 1996 cmd.exe WMIC.exe PID 772 wrote to memory of 1616 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1616 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1616 772 rundll32.exe cmd.exe PID 772 wrote to memory of 1616 772 rundll32.exe cmd.exe PID 1616 wrote to memory of 1992 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1992 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1992 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1992 1616 cmd.exe WMIC.exe PID 772 wrote to memory of 1584 772 rundll32.exe cmd.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rw.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\rw.dll,#12⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete3⤵
-
C:\Windows\SysWOW64\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete4⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-75-0x0000000000000000-mapping.dmp
-
memory/368-76-0x0000000000000000-mapping.dmp
-
memory/484-79-0x0000000000000000-mapping.dmp
-
memory/772-55-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/772-57-0x0000000010000000-0x000000001005C000-memory.dmpFilesize
368KB
-
memory/772-56-0x0000000000190000-0x00000000001DF000-memory.dmpFilesize
316KB
-
memory/772-54-0x0000000000000000-mapping.dmp
-
memory/852-60-0x0000000000000000-mapping.dmp
-
memory/884-67-0x0000000000000000-mapping.dmp
-
memory/976-80-0x0000000000000000-mapping.dmp
-
memory/1080-59-0x0000000000000000-mapping.dmp
-
memory/1196-69-0x0000000000000000-mapping.dmp
-
memory/1512-65-0x0000000000000000-mapping.dmp
-
memory/1536-81-0x0000000000000000-mapping.dmp
-
memory/1556-58-0x0000000000000000-mapping.dmp
-
memory/1584-72-0x0000000000000000-mapping.dmp
-
memory/1616-70-0x0000000000000000-mapping.dmp
-
memory/1736-64-0x0000000000000000-mapping.dmp
-
memory/1748-74-0x0000000000000000-mapping.dmp
-
memory/1768-63-0x0000000000000000-mapping.dmp
-
memory/1864-73-0x0000000000000000-mapping.dmp
-
memory/1936-78-0x0000000000000000-mapping.dmp
-
memory/1940-61-0x0000000000000000-mapping.dmp
-
memory/1948-66-0x0000000000000000-mapping.dmp
-
memory/1992-71-0x0000000000000000-mapping.dmp
-
memory/1996-68-0x0000000000000000-mapping.dmp
-
memory/2008-77-0x0000000000000000-mapping.dmp
-
memory/2008-62-0x0000000000000000-mapping.dmp