Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07/01/2022, 19:44
Static task
static1
Behavioral task
behavioral1
Sample
5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe
-
Size
2.1MB
-
MD5
6552b8bf9ba6a4931548fe65cde76ad4
-
SHA1
0c81ed07b0fcc9b8a4ff983ed83dd1c83c8fa600
-
SHA256
5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c
-
SHA512
4421f18fc7b276977366f4099e0602947b85ab0f0b7a75e818389d35b3d8e9d0b81b8128ef47dff47a45e4541d23512267139f361822e18b7bb807105071448d
Score
10/10
Malware Config
Extracted
Path
C:\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI strain.
As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.
To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/PZ8lOWohN5xGPEYNRMJljsyK7PSBDmbUWQgY74Uvxm8TdMEXICZLVkvTBn5ubLDK
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.
---BEGIN ID---
PZ8lOWohN5xGPEYNRMJljsyK7PSBDmbUWQgY74Uvxm8TdMEXICZLVkvTBn5ubLDK
---END ID---
URLs
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/PZ8lOWohN5xGPEYNRMJljsyK7PSBDmbUWQgY74Uvxm8TdMEXICZLVkvTBn5ubLDK
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\TestPing.tiff => C:\Users\Admin\Pictures\TestPing.tiff.HTLVN 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File renamed C:\Users\Admin\Pictures\PingShow.png => C:\Users\Admin\Pictures\PingShow.png.HTLVN 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Users\Admin\Pictures\RepairEdit.tiff 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File renamed C:\Users\Admin\Pictures\RepairEdit.tiff => C:\Users\Admin\Pictures\RepairEdit.tiff.HTLVN 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File renamed C:\Users\Admin\Pictures\RestoreSwitch.png => C:\Users\Admin\Pictures\RestoreSwitch.png.HTLVN 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File renamed C:\Users\Admin\Pictures\StopSync.crw => C:\Users\Admin\Pictures\StopSync.crw.HTLVN 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Users\Admin\Pictures\TestPing.tiff 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\Wallpaper.jpg" 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\conti.png" 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_F_COL.HXK 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21327_.GIF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME45.CSS 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms_3.6.100.v20140422-1825.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jre7\lib\management\management.properties 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusDoNotDisturb.ico 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29B.GIF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107748.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198102.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_COL.HXC 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Adobe.css 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert.css 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240189.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00468_.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287644.JPG 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB10.BDR 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR48B.GIF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03041I.JPG 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29F.GIF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_F_COL.HXK 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\readme.txt 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02950_.WMF 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 560 vssvc.exe Token: SeRestorePrivilege 560 vssvc.exe Token: SeAuditPrivilege 560 vssvc.exe Token: SeIncreaseQuotaPrivilege 1168 WMIC.exe Token: SeSecurityPrivilege 1168 WMIC.exe Token: SeTakeOwnershipPrivilege 1168 WMIC.exe Token: SeLoadDriverPrivilege 1168 WMIC.exe Token: SeSystemProfilePrivilege 1168 WMIC.exe Token: SeSystemtimePrivilege 1168 WMIC.exe Token: SeProfSingleProcessPrivilege 1168 WMIC.exe Token: SeIncBasePriorityPrivilege 1168 WMIC.exe Token: SeCreatePagefilePrivilege 1168 WMIC.exe Token: SeBackupPrivilege 1168 WMIC.exe Token: SeRestorePrivilege 1168 WMIC.exe Token: SeShutdownPrivilege 1168 WMIC.exe Token: SeDebugPrivilege 1168 WMIC.exe Token: SeSystemEnvironmentPrivilege 1168 WMIC.exe Token: SeRemoteShutdownPrivilege 1168 WMIC.exe Token: SeUndockPrivilege 1168 WMIC.exe Token: SeManageVolumePrivilege 1168 WMIC.exe Token: 33 1168 WMIC.exe Token: 34 1168 WMIC.exe Token: 35 1168 WMIC.exe Token: SeIncreaseQuotaPrivilege 1168 WMIC.exe Token: SeSecurityPrivilege 1168 WMIC.exe Token: SeTakeOwnershipPrivilege 1168 WMIC.exe Token: SeLoadDriverPrivilege 1168 WMIC.exe Token: SeSystemProfilePrivilege 1168 WMIC.exe Token: SeSystemtimePrivilege 1168 WMIC.exe Token: SeProfSingleProcessPrivilege 1168 WMIC.exe Token: SeIncBasePriorityPrivilege 1168 WMIC.exe Token: SeCreatePagefilePrivilege 1168 WMIC.exe Token: SeBackupPrivilege 1168 WMIC.exe Token: SeRestorePrivilege 1168 WMIC.exe Token: SeShutdownPrivilege 1168 WMIC.exe Token: SeDebugPrivilege 1168 WMIC.exe Token: SeSystemEnvironmentPrivilege 1168 WMIC.exe Token: SeRemoteShutdownPrivilege 1168 WMIC.exe Token: SeUndockPrivilege 1168 WMIC.exe Token: SeManageVolumePrivilege 1168 WMIC.exe Token: 33 1168 WMIC.exe Token: 34 1168 WMIC.exe Token: 35 1168 WMIC.exe Token: SeIncreaseQuotaPrivilege 2016 WMIC.exe Token: SeSecurityPrivilege 2016 WMIC.exe Token: SeTakeOwnershipPrivilege 2016 WMIC.exe Token: SeLoadDriverPrivilege 2016 WMIC.exe Token: SeSystemProfilePrivilege 2016 WMIC.exe Token: SeSystemtimePrivilege 2016 WMIC.exe Token: SeProfSingleProcessPrivilege 2016 WMIC.exe Token: SeIncBasePriorityPrivilege 2016 WMIC.exe Token: SeCreatePagefilePrivilege 2016 WMIC.exe Token: SeBackupPrivilege 2016 WMIC.exe Token: SeRestorePrivilege 2016 WMIC.exe Token: SeShutdownPrivilege 2016 WMIC.exe Token: SeDebugPrivilege 2016 WMIC.exe Token: SeSystemEnvironmentPrivilege 2016 WMIC.exe Token: SeRemoteShutdownPrivilege 2016 WMIC.exe Token: SeUndockPrivilege 2016 WMIC.exe Token: SeManageVolumePrivilege 2016 WMIC.exe Token: 33 2016 WMIC.exe Token: 34 2016 WMIC.exe Token: 35 2016 WMIC.exe Token: SeIncreaseQuotaPrivilege 2016 WMIC.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1212 wrote to memory of 1168 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 30 PID 1212 wrote to memory of 1168 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 30 PID 1212 wrote to memory of 1168 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 30 PID 1212 wrote to memory of 1168 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 30 PID 1212 wrote to memory of 2016 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 32 PID 1212 wrote to memory of 2016 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 32 PID 1212 wrote to memory of 2016 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 32 PID 1212 wrote to memory of 2016 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 32 PID 1212 wrote to memory of 2024 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 34 PID 1212 wrote to memory of 2024 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 34 PID 1212 wrote to memory of 2024 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 34 PID 1212 wrote to memory of 2024 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 34 PID 1212 wrote to memory of 980 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 36 PID 1212 wrote to memory of 980 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 36 PID 1212 wrote to memory of 980 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 36 PID 1212 wrote to memory of 980 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 36 PID 1212 wrote to memory of 1732 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 38 PID 1212 wrote to memory of 1732 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 38 PID 1212 wrote to memory of 1732 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 38 PID 1212 wrote to memory of 1732 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 38 PID 1212 wrote to memory of 1076 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 40 PID 1212 wrote to memory of 1076 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 40 PID 1212 wrote to memory of 1076 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 40 PID 1212 wrote to memory of 1076 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 40 PID 1212 wrote to memory of 1560 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 42 PID 1212 wrote to memory of 1560 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 42 PID 1212 wrote to memory of 1560 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 42 PID 1212 wrote to memory of 1560 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 42 PID 1212 wrote to memory of 1496 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 44 PID 1212 wrote to memory of 1496 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 44 PID 1212 wrote to memory of 1496 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 44 PID 1212 wrote to memory of 1496 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 44 PID 1212 wrote to memory of 1616 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 46 PID 1212 wrote to memory of 1616 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 46 PID 1212 wrote to memory of 1616 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 46 PID 1212 wrote to memory of 1616 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 46 PID 1212 wrote to memory of 1996 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 48 PID 1212 wrote to memory of 1996 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 48 PID 1212 wrote to memory of 1996 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 48 PID 1212 wrote to memory of 1996 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 48 PID 1212 wrote to memory of 1332 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 50 PID 1212 wrote to memory of 1332 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 50 PID 1212 wrote to memory of 1332 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 50 PID 1212 wrote to memory of 1332 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 50 PID 1212 wrote to memory of 1196 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 52 PID 1212 wrote to memory of 1196 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 52 PID 1212 wrote to memory of 1196 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 52 PID 1212 wrote to memory of 1196 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 52 PID 1212 wrote to memory of 1820 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 54 PID 1212 wrote to memory of 1820 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 54 PID 1212 wrote to memory of 1820 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 54 PID 1212 wrote to memory of 1820 1212 5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe"C:\Users\Admin\AppData\Local\Temp\5fa3bf951dde536ac87c0c6f6074e400e9a6a6e83fa6a07b617f608e24b4db0c.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete2⤵PID:2024
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete2⤵PID:980
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete2⤵PID:1732
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete2⤵PID:1076
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete2⤵PID:1560
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete2⤵PID:1496
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete2⤵PID:1616
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete2⤵PID:1996
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete2⤵PID:1332
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete2⤵PID:1196
-
-
C:\Windows\System32\wbem\WMIC.exeshadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete2⤵PID:1820
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560