conti | 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1

General

Target

17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
Size

194KB
MD5

f05d144d8921004f1c082c88acbaefa4
SHA1

d8959168b7bb5b22cd146789d1c0be199320de7d
SHA256

17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1
SHA512

e18e2742889ad767804b5770be35b4dafa5f91a43a517b3d71ee29d6ed6f34dc46f2515dfd3144a51e85e05f46f7ea2b59c0851b5965411628fd9e17c4647b72

Score

10^/10

conti ransomware spyware stealer

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- fqAM1Wjx6ZFKZezjt1CnsVfuNcsFUvsiwLgufIXADXkqyWAWww27zBekvcfCaTzh ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\SuspendStart.tif => C:\Users\Admin\Pictures\SuspendStart.tif.NKDCT	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Users\Admin\Pictures\OpenAdd.tiff	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File renamed	C:\Users\Admin\Pictures\OpenAdd.tiff => C:\Users\Admin\Pictures\OpenAdd.tiff.NKDCT	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File renamed	C:\Users\Admin\Pictures\OpenNew.png => C:\Users\Admin\Pictures\OpenNew.png.NKDCT	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File renamed	C:\Users\Admin\Pictures\PingBlock.png => C:\Users\Admin\Pictures\PingBlock.png.NKDCT	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File renamed	C:\Users\Admin\Pictures\PopMerge.tif => C:\Users\Admin\Pictures\PopMerge.tif.NKDCT	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Users\Admin\Pictures\SuspendConvert.tiff	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File renamed	C:\Users\Admin\Pictures\SuspendConvert.tiff => C:\Users\Admin\Pictures\SuspendConvert.tiff.NKDCT	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\EXPEDITN.ELM	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\CopyUnblock.rtf	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215709.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME27.CSS	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WWINTL.REST.IDX_DLL	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostName.XSL	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02094_.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImagesMask.bmp	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME35.CSS	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_ja.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00233_.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15133_.GIF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\1033\OFFICE10.MML	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00238_.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviewers.gif	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01586_.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107254.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV.HXS	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFRES.CFG	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\fr-FR\readme.txt	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR11.POC	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server-15.jar	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBOX.DPV	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\HEADER.GIF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153091.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239611.WMF	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe

pid process

524 17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe

pid	process
524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	812	vssvc.exe
Token: SeRestorePrivilege	812	vssvc.exe
Token: SeAuditPrivilege	812	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1628	WMIC.exe
Token: SeSecurityPrivilege	1628	WMIC.exe
Token: SeTakeOwnershipPrivilege	1628	WMIC.exe
Token: SeLoadDriverPrivilege	1628	WMIC.exe
Token: SeSystemProfilePrivilege	1628	WMIC.exe
Token: SeSystemtimePrivilege	1628	WMIC.exe
Token: SeProfSingleProcessPrivilege	1628	WMIC.exe
Token: SeIncBasePriorityPrivilege	1628	WMIC.exe
Token: SeCreatePagefilePrivilege	1628	WMIC.exe
Token: SeBackupPrivilege	1628	WMIC.exe
Token: SeRestorePrivilege	1628	WMIC.exe
Token: SeShutdownPrivilege	1628	WMIC.exe
Token: SeDebugPrivilege	1628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1628	WMIC.exe
Token: SeRemoteShutdownPrivilege	1628	WMIC.exe
Token: SeUndockPrivilege	1628	WMIC.exe
Token: SeManageVolumePrivilege	1628	WMIC.exe
Token: 33	1628	WMIC.exe
Token: 34	1628	WMIC.exe
Token: 35	1628	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1628	WMIC.exe
Token: SeSecurityPrivilege	1628	WMIC.exe
Token: SeTakeOwnershipPrivilege	1628	WMIC.exe
Token: SeLoadDriverPrivilege	1628	WMIC.exe
Token: SeSystemProfilePrivilege	1628	WMIC.exe
Token: SeSystemtimePrivilege	1628	WMIC.exe
Token: SeProfSingleProcessPrivilege	1628	WMIC.exe
Token: SeIncBasePriorityPrivilege	1628	WMIC.exe
Token: SeCreatePagefilePrivilege	1628	WMIC.exe
Token: SeBackupPrivilege	1628	WMIC.exe
Token: SeRestorePrivilege	1628	WMIC.exe
Token: SeShutdownPrivilege	1628	WMIC.exe
Token: SeDebugPrivilege	1628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1628	WMIC.exe
Token: SeRemoteShutdownPrivilege	1628	WMIC.exe
Token: SeUndockPrivilege	1628	WMIC.exe
Token: SeManageVolumePrivilege	1628	WMIC.exe
Token: 33	1628	WMIC.exe
Token: 34	1628	WMIC.exe
Token: 35	1628	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1504	WMIC.exe
Token: SeSecurityPrivilege	1504	WMIC.exe
Token: SeTakeOwnershipPrivilege	1504	WMIC.exe
Token: SeLoadDriverPrivilege	1504	WMIC.exe
Token: SeSystemProfilePrivilege	1504	WMIC.exe
Token: SeSystemtimePrivilege	1504	WMIC.exe
Token: SeProfSingleProcessPrivilege	1504	WMIC.exe
Token: SeIncBasePriorityPrivilege	1504	WMIC.exe
Token: SeCreatePagefilePrivilege	1504	WMIC.exe
Token: SeBackupPrivilege	1504	WMIC.exe
Token: SeRestorePrivilege	1504	WMIC.exe
Token: SeShutdownPrivilege	1504	WMIC.exe
Token: SeDebugPrivilege	1504	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1504	WMIC.exe
Token: SeRemoteShutdownPrivilege	1504	WMIC.exe
Token: SeUndockPrivilege	1504	WMIC.exe
Token: SeManageVolumePrivilege	1504	WMIC.exe
Token: 33	1504	WMIC.exe
Token: 34	1504	WMIC.exe
Token: 35	1504	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1504	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 524 wrote to memory of 1664	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1664	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1664	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1664	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1664 wrote to memory of 1628	1664	cmd.exe	WMIC.exe
PID 1664 wrote to memory of 1628	1664	cmd.exe	WMIC.exe
PID 1664 wrote to memory of 1628	1664	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1280	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1280	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1280	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1280	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1280 wrote to memory of 1504	1280	cmd.exe	WMIC.exe
PID 1280 wrote to memory of 1504	1280	cmd.exe	WMIC.exe
PID 1280 wrote to memory of 1504	1280	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1484	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1484	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1484	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1484	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1484 wrote to memory of 1540	1484	cmd.exe	WMIC.exe
PID 1484 wrote to memory of 1540	1484	cmd.exe	WMIC.exe
PID 1484 wrote to memory of 1540	1484	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1448	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1448	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1448	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1448	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1448 wrote to memory of 1896	1448	cmd.exe	WMIC.exe
PID 1448 wrote to memory of 1896	1448	cmd.exe	WMIC.exe
PID 1448 wrote to memory of 1896	1448	cmd.exe	WMIC.exe
PID 524 wrote to memory of 892	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 892	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 892	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 892	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 892 wrote to memory of 1116	892	cmd.exe	WMIC.exe
PID 892 wrote to memory of 1116	892	cmd.exe	WMIC.exe
PID 892 wrote to memory of 1116	892	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1476	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1476	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1476	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1476	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1476 wrote to memory of 1620	1476	cmd.exe	WMIC.exe
PID 1476 wrote to memory of 1620	1476	cmd.exe	WMIC.exe
PID 1476 wrote to memory of 1620	1476	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1936	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1936	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1936	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1936	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1936 wrote to memory of 1288	1936	cmd.exe	WMIC.exe
PID 1936 wrote to memory of 1288	1936	cmd.exe	WMIC.exe
PID 1936 wrote to memory of 1288	1936	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1932	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1932	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1932	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1932	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1932 wrote to memory of 1172	1932	cmd.exe	WMIC.exe
PID 1932 wrote to memory of 1172	1932	cmd.exe	WMIC.exe
PID 1932 wrote to memory of 1172	1932	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1084	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1084	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1084	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 524 wrote to memory of 1084	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe
PID 1084 wrote to memory of 1724	1084	cmd.exe	WMIC.exe
PID 1084 wrote to memory of 1724	1084	cmd.exe	WMIC.exe
PID 1084 wrote to memory of 1724	1084	cmd.exe	WMIC.exe
PID 524 wrote to memory of 1884	524	17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe
"C:\Users\Admin\AppData\Local\Temp\17ac91a36237d8f37dcee961ba74c9310a45c009780ea092c3a1e428870ff8a1.exe"
1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C42FD895-B421-4A33-8B73-34420B94C6C4}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{10A95FEA-CE68-4673-91E9-44796907EA8F}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3F8D846B-9DD4-48C1-9EB7-331601E45A01}'" delete
3⤵
PID:1540

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83DB695E-B6C4-4F19-94F5-5AB249FE6E4B}'" delete
3⤵
PID:1896

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E98F490-EC90-48A3-8095-7CAB9F53C350}'" delete
3⤵
PID:1116

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BE04AF18-D313-4450-8D00-0E635D2D4C97}'" delete
3⤵
PID:1620

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEE4CCBC-073C-4640-96A7-6BA7CCA7CF92}'" delete
3⤵
PID:1288

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{865F3304-51C3-4B8F-A536-F05EC48E587F}'" delete
3⤵
PID:1172

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F66D88E2-B57B-4989-8ED8-F69EC00D6AED}'" delete
3⤵
PID:1724

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
2⤵
PID:1884

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D3F6F2F-1FEA-4EF5-B2F9-9AD4D3736A5B}'" delete
3⤵
PID:1188

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
2⤵
PID:1864

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3AB2448F-F186-4CD1-8044-F01D62EBD5C3}'" delete
3⤵
PID:956

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
2⤵
PID:432

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5E61C5BD-F1FA-4763-95D9-47A0D7BD5FDD}'" delete
3⤵
PID:1488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-77-0x0000000000000000-mapping.dmp

Download
memory/524-54-0x00000000751D1000-0x00000000751D3000-memory.dmp

Filesize
8KB

Download
memory/892-63-0x0000000000000000-mapping.dmp

Download
memory/956-76-0x0000000000000000-mapping.dmp

Download
memory/1084-71-0x0000000000000000-mapping.dmp

Download
memory/1116-64-0x0000000000000000-mapping.dmp

Download
memory/1172-70-0x0000000000000000-mapping.dmp

Download
memory/1188-74-0x0000000000000000-mapping.dmp

Download
memory/1280-57-0x0000000000000000-mapping.dmp

Download
memory/1288-68-0x0000000000000000-mapping.dmp

Download
memory/1448-61-0x0000000000000000-mapping.dmp

Download
memory/1476-65-0x0000000000000000-mapping.dmp

Download
memory/1484-59-0x0000000000000000-mapping.dmp

Download
memory/1488-78-0x0000000000000000-mapping.dmp

Download
memory/1504-58-0x0000000000000000-mapping.dmp

Download
memory/1540-60-0x0000000000000000-mapping.dmp

Download
memory/1620-66-0x0000000000000000-mapping.dmp

Download
memory/1628-56-0x0000000000000000-mapping.dmp

Download
memory/1664-55-0x0000000000000000-mapping.dmp

Download
memory/1724-72-0x0000000000000000-mapping.dmp

Download
memory/1864-75-0x0000000000000000-mapping.dmp

Download
memory/1884-73-0x0000000000000000-mapping.dmp

Download
memory/1896-62-0x0000000000000000-mapping.dmp

Download
memory/1932-69-0x0000000000000000-mapping.dmp

Download
memory/1936-67-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads