Overview
overview
10Static
static
8b26138a0e...e7.exe
windows7_x64
108b26138a0e...e7.exe
windows10_x64
10afc65cb796...ce.dll
windows7_x64
10afc65cb796...ce.dll
windows10_x64
10b909f69f36...a9.dll
windows7_x64
10b909f69f36...a9.dll
windows10_x64
10c57d20e273...7b.exe
windows7_x64
10c57d20e273...7b.exe
windows10_x64
10Analysis
-
max time kernel
159s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win10-en-20211208
General
-
Target
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
-
Size
170KB
-
MD5
04ad1d87185dddc361183349a1422bb9
-
SHA1
db0cb2e6da298f692d2ddfb1093bbac147cf5afa
-
SHA256
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b
-
SHA512
40c15ecffa6834260574ae54574ff6aa5ce04ac02514d5c77e40862ff06dc0f70c8272f51b9bf0bf18d2200648985e86648298d82654864bf06d05028a84637e
Malware Config
Extracted
C:\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/wFHogWmXLALGogxBn3kZjCjktZyPGnfVwj8uB3JFXQ0nUC6jrvJ8Eq5AwdbM6zUo
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exedescription ioc process File renamed C:\Users\Admin\Pictures\DenyMerge.png => C:\Users\Admin\Pictures\DenyMerge.png.OUQYN c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File renamed C:\Users\Admin\Pictures\EnterCheckpoint.raw => C:\Users\Admin\Pictures\EnterCheckpoint.raw.OUQYN c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File renamed C:\Users\Admin\Pictures\NewRename.raw => C:\Users\Admin\Pictures\NewRename.raw.OUQYN c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File renamed C:\Users\Admin\Pictures\RequestExport.tif => C:\Users\Admin\Pictures\RequestExport.tif.OUQYN c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File renamed C:\Users\Admin\Pictures\UnblockConvertFrom.tif => C:\Users\Admin\Pictures\UnblockConvertFrom.tif.OUQYN c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Drops desktop.ini file(s) 31 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exedescription ioc process File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Links\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Downloads\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Pictures\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Videos\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Videos\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Documents\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Searches\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Documents\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Libraries\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Desktop\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Music\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Music\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exedescription ioc process File opened for modification C:\Program Files\Internet Explorer\images\bing.ico c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Microsoft Games\Mahjong\en-US\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02439_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099174.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107494.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301044.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099151.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00934_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03236_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00145_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106020.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0213243.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Microsoft Games\FreeCell\en-US\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Microsoft Games\Hearts\es-ES\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SPANISH.LNG c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01145_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\DVD Maker\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SLERROR.XML c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0164153.JPG c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Google\Chrome\Application\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00361_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01143_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01636_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0075478.GIF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\History.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Microsoft Games\More Games\en-US\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152716.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0211981.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292272.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGLISH.LNG c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Microsoft Games\Purble Place\fr-FR\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105230.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00013_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107468.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174635.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105974.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107490.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107512.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSClientManifest.man c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185796.WMF c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exepid process 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 112 vssvc.exe Token: SeRestorePrivilege 112 vssvc.exe Token: SeAuditPrivilege 112 vssvc.exe Token: SeIncreaseQuotaPrivilege 968 WMIC.exe Token: SeSecurityPrivilege 968 WMIC.exe Token: SeTakeOwnershipPrivilege 968 WMIC.exe Token: SeLoadDriverPrivilege 968 WMIC.exe Token: SeSystemProfilePrivilege 968 WMIC.exe Token: SeSystemtimePrivilege 968 WMIC.exe Token: SeProfSingleProcessPrivilege 968 WMIC.exe Token: SeIncBasePriorityPrivilege 968 WMIC.exe Token: SeCreatePagefilePrivilege 968 WMIC.exe Token: SeBackupPrivilege 968 WMIC.exe Token: SeRestorePrivilege 968 WMIC.exe Token: SeShutdownPrivilege 968 WMIC.exe Token: SeDebugPrivilege 968 WMIC.exe Token: SeSystemEnvironmentPrivilege 968 WMIC.exe Token: SeRemoteShutdownPrivilege 968 WMIC.exe Token: SeUndockPrivilege 968 WMIC.exe Token: SeManageVolumePrivilege 968 WMIC.exe Token: 33 968 WMIC.exe Token: 34 968 WMIC.exe Token: 35 968 WMIC.exe Token: SeIncreaseQuotaPrivilege 968 WMIC.exe Token: SeSecurityPrivilege 968 WMIC.exe Token: SeTakeOwnershipPrivilege 968 WMIC.exe Token: SeLoadDriverPrivilege 968 WMIC.exe Token: SeSystemProfilePrivilege 968 WMIC.exe Token: SeSystemtimePrivilege 968 WMIC.exe Token: SeProfSingleProcessPrivilege 968 WMIC.exe Token: SeIncBasePriorityPrivilege 968 WMIC.exe Token: SeCreatePagefilePrivilege 968 WMIC.exe Token: SeBackupPrivilege 968 WMIC.exe Token: SeRestorePrivilege 968 WMIC.exe Token: SeShutdownPrivilege 968 WMIC.exe Token: SeDebugPrivilege 968 WMIC.exe Token: SeSystemEnvironmentPrivilege 968 WMIC.exe Token: SeRemoteShutdownPrivilege 968 WMIC.exe Token: SeUndockPrivilege 968 WMIC.exe Token: SeManageVolumePrivilege 968 WMIC.exe Token: 33 968 WMIC.exe Token: 34 968 WMIC.exe Token: 35 968 WMIC.exe Token: SeIncreaseQuotaPrivilege 1240 WMIC.exe Token: SeSecurityPrivilege 1240 WMIC.exe Token: SeTakeOwnershipPrivilege 1240 WMIC.exe Token: SeLoadDriverPrivilege 1240 WMIC.exe Token: SeSystemProfilePrivilege 1240 WMIC.exe Token: SeSystemtimePrivilege 1240 WMIC.exe Token: SeProfSingleProcessPrivilege 1240 WMIC.exe Token: SeIncBasePriorityPrivilege 1240 WMIC.exe Token: SeCreatePagefilePrivilege 1240 WMIC.exe Token: SeBackupPrivilege 1240 WMIC.exe Token: SeRestorePrivilege 1240 WMIC.exe Token: SeShutdownPrivilege 1240 WMIC.exe Token: SeDebugPrivilege 1240 WMIC.exe Token: SeSystemEnvironmentPrivilege 1240 WMIC.exe Token: SeRemoteShutdownPrivilege 1240 WMIC.exe Token: SeUndockPrivilege 1240 WMIC.exe Token: SeManageVolumePrivilege 1240 WMIC.exe Token: 33 1240 WMIC.exe Token: 34 1240 WMIC.exe Token: 35 1240 WMIC.exe Token: SeIncreaseQuotaPrivilege 1240 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1876 wrote to memory of 1820 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1820 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1820 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1820 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1820 wrote to memory of 968 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 968 1820 cmd.exe WMIC.exe PID 1820 wrote to memory of 968 1820 cmd.exe WMIC.exe PID 1876 wrote to memory of 1824 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1824 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1824 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1824 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1824 wrote to memory of 1240 1824 cmd.exe WMIC.exe PID 1824 wrote to memory of 1240 1824 cmd.exe WMIC.exe PID 1824 wrote to memory of 1240 1824 cmd.exe WMIC.exe PID 1876 wrote to memory of 1328 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1328 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1328 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1328 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1328 wrote to memory of 1532 1328 cmd.exe WMIC.exe PID 1328 wrote to memory of 1532 1328 cmd.exe WMIC.exe PID 1328 wrote to memory of 1532 1328 cmd.exe WMIC.exe PID 1876 wrote to memory of 1016 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1016 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1016 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1016 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1016 wrote to memory of 1828 1016 cmd.exe WMIC.exe PID 1016 wrote to memory of 1828 1016 cmd.exe WMIC.exe PID 1016 wrote to memory of 1828 1016 cmd.exe WMIC.exe PID 1876 wrote to memory of 1776 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1776 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1776 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1776 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1776 wrote to memory of 1136 1776 cmd.exe WMIC.exe PID 1776 wrote to memory of 1136 1776 cmd.exe WMIC.exe PID 1776 wrote to memory of 1136 1776 cmd.exe WMIC.exe PID 1876 wrote to memory of 556 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 556 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 556 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 556 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 556 wrote to memory of 920 556 cmd.exe WMIC.exe PID 556 wrote to memory of 920 556 cmd.exe WMIC.exe PID 556 wrote to memory of 920 556 cmd.exe WMIC.exe PID 1876 wrote to memory of 912 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 912 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 912 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 912 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 912 wrote to memory of 880 912 cmd.exe WMIC.exe PID 912 wrote to memory of 880 912 cmd.exe WMIC.exe PID 912 wrote to memory of 880 912 cmd.exe WMIC.exe PID 1876 wrote to memory of 1616 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1616 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1616 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1616 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1616 wrote to memory of 1064 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1064 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1064 1616 cmd.exe WMIC.exe PID 1876 wrote to memory of 1552 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1552 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1552 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1876 wrote to memory of 1552 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 1552 wrote to memory of 1384 1552 cmd.exe WMIC.exe PID 1552 wrote to memory of 1384 1552 cmd.exe WMIC.exe PID 1552 wrote to memory of 1384 1552 cmd.exe WMIC.exe PID 1876 wrote to memory of 1668 1876 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe"C:\Users\Admin\AppData\Local\Temp\c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete3⤵PID:1532
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete3⤵PID:1828
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete3⤵PID:1136
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete3⤵PID:920
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete3⤵PID:880
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete3⤵PID:1064
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete3⤵PID:1384
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete2⤵PID:1668
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete3⤵PID:788
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete2⤵PID:1140
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete3⤵PID:1628
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete2⤵PID:1808
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete3⤵PID:1716
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete2⤵PID:972
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete3⤵PID:856
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:112