Overview
overview
10Static
static
8b26138a0e...e7.exe
windows7_x64
108b26138a0e...e7.exe
windows10_x64
10afc65cb796...ce.dll
windows7_x64
10afc65cb796...ce.dll
windows10_x64
10b909f69f36...a9.dll
windows7_x64
10b909f69f36...a9.dll
windows10_x64
10c57d20e273...7b.exe
windows7_x64
10c57d20e273...7b.exe
windows10_x64
10Analysis
-
max time kernel
169s -
max time network
175s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 04:24
Static task
static1
Behavioral task
behavioral1
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8b26138a0e371f06fb51679c8d89f661c6ace3d35a90e569887a1b14ac5938e7.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
afc65cb796c07fb38254e466b2eea7e395c44341aee475cfbce0a5e2ac45b5ce.dll
Resource
win10-en-20211208
Behavioral task
behavioral5
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
b909f69f36244617ab5fc0c2d80466daf4eea3c0e85aab5060ca7f1a122758a9.dll
Resource
win10-en-20211208
Behavioral task
behavioral7
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
Resource
win10-en-20211208
General
-
Target
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe
-
Size
170KB
-
MD5
04ad1d87185dddc361183349a1422bb9
-
SHA1
db0cb2e6da298f692d2ddfb1093bbac147cf5afa
-
SHA256
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b
-
SHA512
40c15ecffa6834260574ae54574ff6aa5ce04ac02514d5c77e40862ff06dc0f70c8272f51b9bf0bf18d2200648985e86648298d82654864bf06d05028a84637e
Malware Config
Extracted
C:\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/wFHogWmXLALGogxBn3kZjCjktZyPGnfVwj8uB3JFXQ0nUC6jrvJ8Eq5AwdbM6zUo
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exedescription ioc process File renamed C:\Users\Admin\Pictures\LimitWait.tiff => C:\Users\Admin\Pictures\LimitWait.tiff.OUQYN c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File renamed C:\Users\Admin\Pictures\ExitGroup.tif => C:\Users\Admin\Pictures\ExitGroup.tif.OUQYN c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Pictures\LimitWait.tiff c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Drops desktop.ini file(s) 28 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exedescription ioc process File opened for modification C:\Users\Admin\Documents\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Links\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Videos\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Desktop\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Libraries\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Downloads\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Documents\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Music\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Music\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Searches\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Pictures\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Public\Videos\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Drops file in Program Files directory 64 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Microsoft Office\root\loc\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\oledbvbs.inc c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Common Files\microsoft shared\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jfxswt.jar c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Google\Chrome\Application\89.0.4389.114\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\delete.avi c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\descript.ion c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\FlickAnimation.avi c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Soft Blue.htm c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Internet Explorer\en-US\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RDCNotificationClient.appx c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaTypewriterBold.ttf c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Google\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsyml.ttf c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\content-types.properties c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOCRRES.ORP c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\HandPrints.jpg c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File created C:\Program Files\Common Files\System\ado\fr-FR\readme.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exepid process 2736 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe 2736 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 632 vssvc.exe Token: SeRestorePrivilege 632 vssvc.exe Token: SeAuditPrivilege 632 vssvc.exe Token: SeIncreaseQuotaPrivilege 3644 WMIC.exe Token: SeSecurityPrivilege 3644 WMIC.exe Token: SeTakeOwnershipPrivilege 3644 WMIC.exe Token: SeLoadDriverPrivilege 3644 WMIC.exe Token: SeSystemProfilePrivilege 3644 WMIC.exe Token: SeSystemtimePrivilege 3644 WMIC.exe Token: SeProfSingleProcessPrivilege 3644 WMIC.exe Token: SeIncBasePriorityPrivilege 3644 WMIC.exe Token: SeCreatePagefilePrivilege 3644 WMIC.exe Token: SeBackupPrivilege 3644 WMIC.exe Token: SeRestorePrivilege 3644 WMIC.exe Token: SeShutdownPrivilege 3644 WMIC.exe Token: SeDebugPrivilege 3644 WMIC.exe Token: SeSystemEnvironmentPrivilege 3644 WMIC.exe Token: SeRemoteShutdownPrivilege 3644 WMIC.exe Token: SeUndockPrivilege 3644 WMIC.exe Token: SeManageVolumePrivilege 3644 WMIC.exe Token: 33 3644 WMIC.exe Token: 34 3644 WMIC.exe Token: 35 3644 WMIC.exe Token: 36 3644 WMIC.exe Token: SeIncreaseQuotaPrivilege 3644 WMIC.exe Token: SeSecurityPrivilege 3644 WMIC.exe Token: SeTakeOwnershipPrivilege 3644 WMIC.exe Token: SeLoadDriverPrivilege 3644 WMIC.exe Token: SeSystemProfilePrivilege 3644 WMIC.exe Token: SeSystemtimePrivilege 3644 WMIC.exe Token: SeProfSingleProcessPrivilege 3644 WMIC.exe Token: SeIncBasePriorityPrivilege 3644 WMIC.exe Token: SeCreatePagefilePrivilege 3644 WMIC.exe Token: SeBackupPrivilege 3644 WMIC.exe Token: SeRestorePrivilege 3644 WMIC.exe Token: SeShutdownPrivilege 3644 WMIC.exe Token: SeDebugPrivilege 3644 WMIC.exe Token: SeSystemEnvironmentPrivilege 3644 WMIC.exe Token: SeRemoteShutdownPrivilege 3644 WMIC.exe Token: SeUndockPrivilege 3644 WMIC.exe Token: SeManageVolumePrivilege 3644 WMIC.exe Token: 33 3644 WMIC.exe Token: 34 3644 WMIC.exe Token: 35 3644 WMIC.exe Token: 36 3644 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.execmd.exedescription pid process target process PID 2736 wrote to memory of 3984 2736 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 2736 wrote to memory of 3984 2736 c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe cmd.exe PID 3984 wrote to memory of 3644 3984 cmd.exe WMIC.exe PID 3984 wrote to memory of 3644 3984 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe"C:\Users\Admin\AppData\Local\Temp\c57d20e273337da5239f1573212adc60eacf470873e67ea135508c7c749da37b.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83F9F456-EB31-477C-9802-9A0BF76D63FC}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{83F9F456-EB31-477C-9802-9A0BF76D63FC}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:632