Overview
overview
10Static
static
8b26138a0e...e7.exe
windows7_x64
108b26138a0e...e7.exe
windows10_x64
10afc65cb796...ce.dll
windows7_x64
10afc65cb796...ce.dll
windows10_x64
10b909f69f36...a9.dll
windows7_x64
10b909f69f36...a9.dll
windows10_x64
10c57d20e273...7b.exe
windows7_x64
10c57d20e273...7b.exe
windows10_x64
10Analysis
-
max time kernel
154s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win10-en-20211208
General
-
Target
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
-
Size
196KB
-
MD5
b11ea7564115dbf8de1d73c916d8caa2
-
SHA1
5c72eba30754f697f4ed1d0f3b344e4cd3dbd937
-
SHA256
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7
-
SHA512
7eed10a5fff17d16583ea8578eafcbf3d81fb98eb6e73a94e93d7c0286c1e47a979dffc874e0de57b873ff2c4a49f3f1d3306108c9cb70127ad58ec91abef6d9
Malware Config
Extracted
C:\readme.txt
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exedescription ioc process File renamed C:\Users\Admin\Pictures\ReceiveRedo.tif => C:\Users\Admin\Pictures\ReceiveRedo.tif.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\SendUnblock.png => C:\Users\Admin\Pictures\SendUnblock.png.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\ShowDisable.raw => C:\Users\Admin\Pictures\ShowDisable.raw.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\ShowMount.png => C:\Users\Admin\Pictures\ShowMount.png.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\InvokeLimit.crw => C:\Users\Admin\Pictures\InvokeLimit.crw.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File renamed C:\Users\Admin\Pictures\ReceiveExpand.raw => C:\Users\Admin\Pictures\ReceiveExpand.raw.SHQSI 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Drops desktop.ini file(s) 24 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exedescription ioc process File opened for modification C:\Users\Public\Videos\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Music\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Documents\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files (x86)\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Links\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Music\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Drops file in Program Files directory 64 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcjavas.inc 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files\Google\Chrome\Application\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy.jar 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\ExportFormat.mp4 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ul-phn.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\HideSubmit.mht 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\CheckpointBackup.TTS 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\readme.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\classlist 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exepid process 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 3932 vssvc.exe Token: SeRestorePrivilege 3932 vssvc.exe Token: SeAuditPrivilege 3932 vssvc.exe Token: SeIncreaseQuotaPrivilege 3124 WMIC.exe Token: SeSecurityPrivilege 3124 WMIC.exe Token: SeTakeOwnershipPrivilege 3124 WMIC.exe Token: SeLoadDriverPrivilege 3124 WMIC.exe Token: SeSystemProfilePrivilege 3124 WMIC.exe Token: SeSystemtimePrivilege 3124 WMIC.exe Token: SeProfSingleProcessPrivilege 3124 WMIC.exe Token: SeIncBasePriorityPrivilege 3124 WMIC.exe Token: SeCreatePagefilePrivilege 3124 WMIC.exe Token: SeBackupPrivilege 3124 WMIC.exe Token: SeRestorePrivilege 3124 WMIC.exe Token: SeShutdownPrivilege 3124 WMIC.exe Token: SeDebugPrivilege 3124 WMIC.exe Token: SeSystemEnvironmentPrivilege 3124 WMIC.exe Token: SeRemoteShutdownPrivilege 3124 WMIC.exe Token: SeUndockPrivilege 3124 WMIC.exe Token: SeManageVolumePrivilege 3124 WMIC.exe Token: 33 3124 WMIC.exe Token: 34 3124 WMIC.exe Token: 35 3124 WMIC.exe Token: 36 3124 WMIC.exe Token: SeIncreaseQuotaPrivilege 3124 WMIC.exe Token: SeSecurityPrivilege 3124 WMIC.exe Token: SeTakeOwnershipPrivilege 3124 WMIC.exe Token: SeLoadDriverPrivilege 3124 WMIC.exe Token: SeSystemProfilePrivilege 3124 WMIC.exe Token: SeSystemtimePrivilege 3124 WMIC.exe Token: SeProfSingleProcessPrivilege 3124 WMIC.exe Token: SeIncBasePriorityPrivilege 3124 WMIC.exe Token: SeCreatePagefilePrivilege 3124 WMIC.exe Token: SeBackupPrivilege 3124 WMIC.exe Token: SeRestorePrivilege 3124 WMIC.exe Token: SeShutdownPrivilege 3124 WMIC.exe Token: SeDebugPrivilege 3124 WMIC.exe Token: SeSystemEnvironmentPrivilege 3124 WMIC.exe Token: SeRemoteShutdownPrivilege 3124 WMIC.exe Token: SeUndockPrivilege 3124 WMIC.exe Token: SeManageVolumePrivilege 3124 WMIC.exe Token: 33 3124 WMIC.exe Token: 34 3124 WMIC.exe Token: 35 3124 WMIC.exe Token: 36 3124 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.execmd.exedescription pid process target process PID 2704 wrote to memory of 2952 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 2704 wrote to memory of 2952 2704 8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe cmd.exe PID 2952 wrote to memory of 3124 2952 cmd.exe WMIC.exe PID 2952 wrote to memory of 3124 2952 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe"C:\Users\Admin\AppData\Local\Temp\8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83F9F456-EB31-477C-9802-9A0BF76D63FC}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83F9F456-EB31-477C-9802-9A0BF76D63FC}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932