Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
23-11-2021 17:42
Static task
static1
Behavioral task
behavioral1
Sample
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe
Resource
win10-en-20211104
General
-
Target
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe
-
Size
194KB
-
MD5
31c250609693ca7450a1d79840c51057
-
SHA1
eca2dea03f2c5eac7bbf54e1d212f0fc61d936f8
-
SHA256
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9
-
SHA512
eac254d9a4950666747fad7534c815bafcdc75b6862bb442c9a4d9b4c00aedc2e9317514b7e76f5453c4f0ca55327c88e8cec743a46ccac78fcbfa3e32700424
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.ws
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exedescription ioc process File renamed C:\Users\Admin\Pictures\MountDeny.raw => C:\Users\Admin\Pictures\MountDeny.raw.PYZWR f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File renamed C:\Users\Admin\Pictures\SyncRestore.crw => C:\Users\Admin\Pictures\SyncRestore.crw.PYZWR f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File renamed C:\Users\Admin\Pictures\UseRevoke.crw => C:\Users\Admin\Pictures\UseRevoke.crw.PYZWR f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285782.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\readme.txt f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\rt.jar f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\SOLVER.XLAM f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.data\readme.txt f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237759.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7es.kic f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Esl\readme.txt f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115844.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\readme.txt f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OFFLINE.ICO f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02208U.BMP f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\readme.txt f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_OFF.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\PREVIEW.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\EXPEDITN.INF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01761_.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14981_.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\LICENSE f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185842.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\TYPE.WAV f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLCPRTID.XML f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00373_.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-util.xml f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\readme.txt f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00305_.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\PREVIEW.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14655_.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00364_.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\StopConnect.jpeg f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSWAVY.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\readme.txt f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 952 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exepid process 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 920 vssvc.exe Token: SeRestorePrivilege 920 vssvc.exe Token: SeAuditPrivilege 920 vssvc.exe Token: SeIncreaseQuotaPrivilege 780 WMIC.exe Token: SeSecurityPrivilege 780 WMIC.exe Token: SeTakeOwnershipPrivilege 780 WMIC.exe Token: SeLoadDriverPrivilege 780 WMIC.exe Token: SeSystemProfilePrivilege 780 WMIC.exe Token: SeSystemtimePrivilege 780 WMIC.exe Token: SeProfSingleProcessPrivilege 780 WMIC.exe Token: SeIncBasePriorityPrivilege 780 WMIC.exe Token: SeCreatePagefilePrivilege 780 WMIC.exe Token: SeBackupPrivilege 780 WMIC.exe Token: SeRestorePrivilege 780 WMIC.exe Token: SeShutdownPrivilege 780 WMIC.exe Token: SeDebugPrivilege 780 WMIC.exe Token: SeSystemEnvironmentPrivilege 780 WMIC.exe Token: SeRemoteShutdownPrivilege 780 WMIC.exe Token: SeUndockPrivilege 780 WMIC.exe Token: SeManageVolumePrivilege 780 WMIC.exe Token: 33 780 WMIC.exe Token: 34 780 WMIC.exe Token: 35 780 WMIC.exe Token: SeIncreaseQuotaPrivilege 780 WMIC.exe Token: SeSecurityPrivilege 780 WMIC.exe Token: SeTakeOwnershipPrivilege 780 WMIC.exe Token: SeLoadDriverPrivilege 780 WMIC.exe Token: SeSystemProfilePrivilege 780 WMIC.exe Token: SeSystemtimePrivilege 780 WMIC.exe Token: SeProfSingleProcessPrivilege 780 WMIC.exe Token: SeIncBasePriorityPrivilege 780 WMIC.exe Token: SeCreatePagefilePrivilege 780 WMIC.exe Token: SeBackupPrivilege 780 WMIC.exe Token: SeRestorePrivilege 780 WMIC.exe Token: SeShutdownPrivilege 780 WMIC.exe Token: SeDebugPrivilege 780 WMIC.exe Token: SeSystemEnvironmentPrivilege 780 WMIC.exe Token: SeRemoteShutdownPrivilege 780 WMIC.exe Token: SeUndockPrivilege 780 WMIC.exe Token: SeManageVolumePrivilege 780 WMIC.exe Token: 33 780 WMIC.exe Token: 34 780 WMIC.exe Token: 35 780 WMIC.exe Token: SeIncreaseQuotaPrivilege 1176 WMIC.exe Token: SeSecurityPrivilege 1176 WMIC.exe Token: SeTakeOwnershipPrivilege 1176 WMIC.exe Token: SeLoadDriverPrivilege 1176 WMIC.exe Token: SeSystemProfilePrivilege 1176 WMIC.exe Token: SeSystemtimePrivilege 1176 WMIC.exe Token: SeProfSingleProcessPrivilege 1176 WMIC.exe Token: SeIncBasePriorityPrivilege 1176 WMIC.exe Token: SeCreatePagefilePrivilege 1176 WMIC.exe Token: SeBackupPrivilege 1176 WMIC.exe Token: SeRestorePrivilege 1176 WMIC.exe Token: SeShutdownPrivilege 1176 WMIC.exe Token: SeDebugPrivilege 1176 WMIC.exe Token: SeSystemEnvironmentPrivilege 1176 WMIC.exe Token: SeRemoteShutdownPrivilege 1176 WMIC.exe Token: SeUndockPrivilege 1176 WMIC.exe Token: SeManageVolumePrivilege 1176 WMIC.exe Token: 33 1176 WMIC.exe Token: 34 1176 WMIC.exe Token: 35 1176 WMIC.exe Token: SeIncreaseQuotaPrivilege 1176 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1876 wrote to memory of 808 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 808 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 808 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 808 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 808 wrote to memory of 780 808 cmd.exe WMIC.exe PID 808 wrote to memory of 780 808 cmd.exe WMIC.exe PID 808 wrote to memory of 780 808 cmd.exe WMIC.exe PID 1876 wrote to memory of 1560 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1560 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1560 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1560 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1560 wrote to memory of 1176 1560 cmd.exe WMIC.exe PID 1560 wrote to memory of 1176 1560 cmd.exe WMIC.exe PID 1560 wrote to memory of 1176 1560 cmd.exe WMIC.exe PID 1876 wrote to memory of 1276 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1276 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1276 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1276 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1276 wrote to memory of 1944 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1944 1276 cmd.exe WMIC.exe PID 1276 wrote to memory of 1944 1276 cmd.exe WMIC.exe PID 1876 wrote to memory of 1888 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1888 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1888 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1888 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1888 wrote to memory of 884 1888 cmd.exe WMIC.exe PID 1888 wrote to memory of 884 1888 cmd.exe WMIC.exe PID 1888 wrote to memory of 884 1888 cmd.exe WMIC.exe PID 1876 wrote to memory of 944 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 944 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 944 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 944 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 944 wrote to memory of 1636 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1636 944 cmd.exe WMIC.exe PID 944 wrote to memory of 1636 944 cmd.exe WMIC.exe PID 1876 wrote to memory of 980 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 980 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 980 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 980 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 980 wrote to memory of 1988 980 cmd.exe WMIC.exe PID 980 wrote to memory of 1988 980 cmd.exe WMIC.exe PID 980 wrote to memory of 1988 980 cmd.exe WMIC.exe PID 1876 wrote to memory of 1624 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1624 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1624 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1624 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1624 wrote to memory of 608 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 608 1624 cmd.exe WMIC.exe PID 1624 wrote to memory of 608 1624 cmd.exe WMIC.exe PID 1876 wrote to memory of 1056 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1056 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1056 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1056 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1056 wrote to memory of 808 1056 cmd.exe WMIC.exe PID 1056 wrote to memory of 808 1056 cmd.exe WMIC.exe PID 1056 wrote to memory of 808 1056 cmd.exe WMIC.exe PID 1876 wrote to memory of 1136 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1136 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1136 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1876 wrote to memory of 1136 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe PID 1136 wrote to memory of 1560 1136 cmd.exe WMIC.exe PID 1136 wrote to memory of 1560 1136 cmd.exe WMIC.exe PID 1136 wrote to memory of 1560 1136 cmd.exe WMIC.exe PID 1876 wrote to memory of 1996 1876 f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\f11724258acba02fa817e411878cd2506c09f4d00fcc47302f55dc7748d50fd9.bin.sample.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{688377E4-B9C8-46C8-9E9F-761D801E9C51}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{688377E4-B9C8-46C8-9E9F-761D801E9C51}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B87D77AA-377B-4092-91E6-D8EF823EC505}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B87D77AA-377B-4092-91E6-D8EF823EC505}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6B69DCC8-B6BE-413E-8BD1-B32E7079E547}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6B69DCC8-B6BE-413E-8BD1-B32E7079E547}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6C32C5FD-1830-45C0-8EFC-ADA3CDAB334C}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6C32C5FD-1830-45C0-8EFC-ADA3CDAB334C}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E7DFD216-D9E4-4A0D-AAB3-BE68833AF6B0}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E7DFD216-D9E4-4A0D-AAB3-BE68833AF6B0}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{02974537-B9D8-4D22-A25D-2642DECBD2E0}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{02974537-B9D8-4D22-A25D-2642DECBD2E0}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1A0A39E-9C0E-45CD-AAE6-883919D3C98F}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1A0A39E-9C0E-45CD-AAE6-883919D3C98F}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C3F23FFE-B354-43EE-AF82-4C5563205565}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C3F23FFE-B354-43EE-AF82-4C5563205565}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{395FA19E-995F-4350-BDBF-D4310D77F343}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{395FA19E-995F-4350-BDBF-D4310D77F343}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6C509F8F-1E46-4E1C-923E-A115333C9064}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6C509F8F-1E46-4E1C-923E-A115333C9064}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2CEA3952-D158-405E-827B-2C6C534FE7CB}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2CEA3952-D158-405E-827B-2C6C534FE7CB}'" delete3⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B366BDD6-0DF8-41AD-8E62-E73FD0D134D4}'" delete2⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B366BDD6-0DF8-41AD-8E62-E73FD0D134D4}'" delete3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\readme.txtMD5
99d61a6ea8c6d6df2b07c1885461260f
SHA10d655a6c42b758ed05f88c65a11d3d66d9a46314
SHA25664ce05600e8afb96aedb3c792be8f059300952b347a178f07117aec55ccb28f9
SHA512f3806833419b68c4b1c5762817096da322a6d1f7af264f2b968240d6ee69fc61c5c2e82443ce593ac2077eb8d4253581b0d0268b3df6572801b5e08bfb494150
-
memory/608-69-0x0000000000000000-mapping.dmp
-
memory/780-57-0x0000000000000000-mapping.dmp
-
memory/808-56-0x0000000000000000-mapping.dmp
-
memory/808-71-0x0000000000000000-mapping.dmp
-
memory/884-63-0x0000000000000000-mapping.dmp
-
memory/944-64-0x0000000000000000-mapping.dmp
-
memory/944-79-0x0000000000000000-mapping.dmp
-
memory/952-80-0x000007FEFC441000-0x000007FEFC443000-memory.dmpFilesize
8KB
-
memory/968-77-0x0000000000000000-mapping.dmp
-
memory/980-66-0x0000000000000000-mapping.dmp
-
memory/1056-70-0x0000000000000000-mapping.dmp
-
memory/1136-72-0x0000000000000000-mapping.dmp
-
memory/1176-59-0x0000000000000000-mapping.dmp
-
memory/1276-60-0x0000000000000000-mapping.dmp
-
memory/1560-73-0x0000000000000000-mapping.dmp
-
memory/1560-58-0x0000000000000000-mapping.dmp
-
memory/1624-68-0x0000000000000000-mapping.dmp
-
memory/1636-65-0x0000000000000000-mapping.dmp
-
memory/1644-75-0x0000000000000000-mapping.dmp
-
memory/1728-78-0x0000000000000000-mapping.dmp
-
memory/1876-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB
-
memory/1888-62-0x0000000000000000-mapping.dmp
-
memory/1904-76-0x0000000000000000-mapping.dmp
-
memory/1944-61-0x0000000000000000-mapping.dmp
-
memory/1988-67-0x0000000000000000-mapping.dmp
-
memory/1996-74-0x0000000000000000-mapping.dmp