conti | 28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69

General

Target

28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
Size

195KB
MD5

2d5445247a4502864d05b71537b7b516
SHA1

fbf278fcc0d0e88fb0ee280b5085a7fb23a84f2b
SHA256

28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69
SHA512

2218efc1264d63583bd07c46f3d6a2a61c61d870b60a9776f374c76737bc1b5cc3d340a11a6c0fafd336939ef31f9395204238b7e98e1635b796e403c059b1fa

Score

10^/10

conti ransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- ec5sSORrGN3JYtjUtK7QvDv7ZtnFwgcUnCEmqJITc9YfyoAPydlyCoE1FHyB8wCq ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Drops file in Program Files directory 64 IoCs

Processes:

28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Sync Framework\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\MSBuild\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\CompleteInitialize.wma	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Mozilla Firefox\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Adobe\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\sonicsptransform.ax	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Internet Explorer\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\ConvertToInvoke.m4a	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Google\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Uninstall Information\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\ExportSearch.pot	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\DVD Maker\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\Eurosti.TTF	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Java\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\CheckpointProtect.MOD	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\directshowtap.ax	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\soniccolorconverter.ax	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsource.ax	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Microsoft Office\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Office\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\RevokeSkip.dotm	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Common Files\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\bod_r.TTF	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Common Files\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsink.ax	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\VideoLAN\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft.NET\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\AddDismount.au3	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\InstallRepair.xla	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Mozilla Firefox\removed-files	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Reference Assemblies\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Microsoft Games\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Internet Explorer\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\SyncAdd.M2V	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\Uninstall Information\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Reference Assemblies\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\DVD Maker\audiodepthconverter.ax	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\ResolveSuspend.jtx	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\Internet Explorer\ie9props.propdesc	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
File created	C:\Program Files\7-Zip\Lang\readme.txt	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe

pid process

744 28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe

pid	process
744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	292	vssvc.exe
Token: SeRestorePrivilege	292	vssvc.exe
Token: SeAuditPrivilege	292	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1368	WMIC.exe
Token: SeSecurityPrivilege	1368	WMIC.exe
Token: SeTakeOwnershipPrivilege	1368	WMIC.exe
Token: SeLoadDriverPrivilege	1368	WMIC.exe
Token: SeSystemProfilePrivilege	1368	WMIC.exe
Token: SeSystemtimePrivilege	1368	WMIC.exe
Token: SeProfSingleProcessPrivilege	1368	WMIC.exe
Token: SeIncBasePriorityPrivilege	1368	WMIC.exe
Token: SeCreatePagefilePrivilege	1368	WMIC.exe
Token: SeBackupPrivilege	1368	WMIC.exe
Token: SeRestorePrivilege	1368	WMIC.exe
Token: SeShutdownPrivilege	1368	WMIC.exe
Token: SeDebugPrivilege	1368	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1368	WMIC.exe
Token: SeRemoteShutdownPrivilege	1368	WMIC.exe
Token: SeUndockPrivilege	1368	WMIC.exe
Token: SeManageVolumePrivilege	1368	WMIC.exe
Token: 33	1368	WMIC.exe
Token: 34	1368	WMIC.exe
Token: 35	1368	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1368	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 744 wrote to memory of 1468	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1468	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1468	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1468	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 1468 wrote to memory of 1200	1468	cmd.exe	WMIC.exe
PID 1468 wrote to memory of 1200	1468	cmd.exe	WMIC.exe
PID 1468 wrote to memory of 1200	1468	cmd.exe	WMIC.exe
PID 744 wrote to memory of 1872	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1872	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1872	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1872	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 1872 wrote to memory of 1368	1872	cmd.exe	WMIC.exe
PID 1872 wrote to memory of 1368	1872	cmd.exe	WMIC.exe
PID 1872 wrote to memory of 1368	1872	cmd.exe	WMIC.exe
PID 744 wrote to memory of 1820	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1820	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1820	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1820	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 1820 wrote to memory of 1684	1820	cmd.exe	WMIC.exe
PID 1820 wrote to memory of 1684	1820	cmd.exe	WMIC.exe
PID 1820 wrote to memory of 1684	1820	cmd.exe	WMIC.exe
PID 744 wrote to memory of 1500	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1500	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1500	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1500	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 1500 wrote to memory of 1716	1500	cmd.exe	WMIC.exe
PID 1500 wrote to memory of 1716	1500	cmd.exe	WMIC.exe
PID 1500 wrote to memory of 1716	1500	cmd.exe	WMIC.exe
PID 744 wrote to memory of 896	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 896	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 896	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 896	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 896 wrote to memory of 980	896	cmd.exe	WMIC.exe
PID 896 wrote to memory of 980	896	cmd.exe	WMIC.exe
PID 896 wrote to memory of 980	896	cmd.exe	WMIC.exe
PID 744 wrote to memory of 1440	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1440	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1440	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1440	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1392	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1392	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1392	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1392	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 1392 wrote to memory of 1860	1392	cmd.exe	WMIC.exe
PID 1392 wrote to memory of 1860	1392	cmd.exe	WMIC.exe
PID 1392 wrote to memory of 1860	1392	cmd.exe	WMIC.exe
PID 744 wrote to memory of 1000	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1000	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1000	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1000	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 1000 wrote to memory of 1276	1000	cmd.exe	WMIC.exe
PID 1000 wrote to memory of 1276	1000	cmd.exe	WMIC.exe
PID 1000 wrote to memory of 1276	1000	cmd.exe	WMIC.exe
PID 744 wrote to memory of 1700	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1700	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1700	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 1700	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 1700 wrote to memory of 1764	1700	cmd.exe	WMIC.exe
PID 1700 wrote to memory of 1764	1700	cmd.exe	WMIC.exe
PID 1700 wrote to memory of 1764	1700	cmd.exe	WMIC.exe
PID 744 wrote to memory of 240	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 240	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 240	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe
PID 744 wrote to memory of 240	744	28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\28fea198b1a127ecc10411d711c4df087fc2aa371223a02c13cad92dc465fc69.bin.sample.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{42AB00D9-23AC-4D9F-BCD0-F560B4FBD4B0}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{42AB00D9-23AC-4D9F-BCD0-F560B4FBD4B0}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C90CD5D7-9B6C-471C-8C96-355998B14EF8}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C90CD5D7-9B6C-471C-8C96-355998B14EF8}'" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1F9BD2A6-5BF7-4A73-A29E-C733297088AB}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1F9BD2A6-5BF7-4A73-A29E-C733297088AB}'" delete
3⤵
PID:1684

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B0CDB24-FE85-46C3-A922-261B4710F554}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B0CDB24-FE85-46C3-A922-261B4710F554}'" delete
3⤵
PID:1716

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EA725A54-6608-4CC5-ADB5-8264BCE7D769}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EA725A54-6608-4CC5-ADB5-8264BCE7D769}'" delete
3⤵
PID:980

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C69100F5-3145-4E28-8E5C-905B7935BC10}'" delete
2⤵
PID:1440

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C69100F5-3145-4E28-8E5C-905B7935BC10}'" delete
3⤵
PID:1696

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{96D0CAC1-C317-4BB6-AD1F-99B2256E98E5}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{96D0CAC1-C317-4BB6-AD1F-99B2256E98E5}'" delete
3⤵
PID:1860

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1EA4E4BE-24E6-4635-B5FF-53620C5E736C}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1EA4E4BE-24E6-4635-B5FF-53620C5E736C}'" delete
3⤵
PID:1276

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FFF06B0E-2058-4D70-B8BC-18A1A005070D}'" delete
2⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FFF06B0E-2058-4D70-B8BC-18A1A005070D}'" delete
3⤵
PID:1764

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EE3200B8-7AB9-430D-B09F-BF068E5C27EF}'" delete
2⤵
PID:240

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EE3200B8-7AB9-430D-B09F-BF068E5C27EF}'" delete
3⤵
PID:684

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{94294216-2812-4D17-858B-782E99F60969}'" delete
2⤵
PID:944

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{94294216-2812-4D17-858B-782E99F60969}'" delete
3⤵
PID:1164

C:\Windows\system32\cmd.exe
cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5803ED3F-C3C9-4EEB-988E-4C0536D60FE3}'" delete
2⤵
PID:1196

C:\Windows\System32\wbem\WMIC.exe
C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5803ED3F-C3C9-4EEB-988E-4C0536D60FE3}'" delete
3⤵
PID:1300

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-73-0x0000000000000000-mapping.dmp

Download
memory/684-74-0x0000000000000000-mapping.dmp

Download
memory/744-55-0x0000000076A21000-0x0000000076A23000-memory.dmp

Filesize
8KB

Download
memory/896-64-0x0000000000000000-mapping.dmp

Download
memory/944-75-0x0000000000000000-mapping.dmp

Download
memory/980-65-0x0000000000000000-mapping.dmp

Download
memory/1000-69-0x0000000000000000-mapping.dmp

Download
memory/1164-76-0x0000000000000000-mapping.dmp

Download
memory/1196-77-0x0000000000000000-mapping.dmp

Download
memory/1200-57-0x0000000000000000-mapping.dmp

Download
memory/1276-70-0x0000000000000000-mapping.dmp

Download
memory/1300-78-0x0000000000000000-mapping.dmp

Download
memory/1368-59-0x0000000000000000-mapping.dmp

Download
memory/1392-67-0x0000000000000000-mapping.dmp

Download
memory/1440-66-0x0000000000000000-mapping.dmp

Download
memory/1468-56-0x0000000000000000-mapping.dmp

Download
memory/1500-62-0x0000000000000000-mapping.dmp

Download
memory/1684-61-0x0000000000000000-mapping.dmp

Download
memory/1700-71-0x0000000000000000-mapping.dmp

Download
memory/1716-63-0x0000000000000000-mapping.dmp

Download
memory/1764-72-0x0000000000000000-mapping.dmp

Download
memory/1820-60-0x0000000000000000-mapping.dmp

Download
memory/1860-68-0x0000000000000000-mapping.dmp

Download
memory/1872-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads