Analysis
-
max time kernel
152s -
max time network
140s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 15:51
Static task
static1
Behavioral task
behavioral1
Sample
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe
Resource
win10-en-20211208
General
-
Target
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe
-
Size
624KB
-
MD5
7e18dd4a4b84f2f93eff4790f16e8e8b
-
SHA1
3113dbbeb536000ac8175ccb6438355af41ab2eb
-
SHA256
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9
-
SHA512
3edfa60480ec1e0a6b5ce01d99cf0156fe544a77944ccd87acf95dcd0667cdfe4a2b99e9988cee0e597de03aa96d8098ae3f324fe63ca37db688522e5ec87fca
Malware Config
Extracted
C:\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/MAYeHZzawPjL51jqGnH1euFenWdJSCSx4LjdiNz46bQ2ZPugz83x52n5vqW0O76L
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Dave packer 1 IoCs
Detects executable using a packer named 'Dave' by the community, based on a string at the end.
Processes:
resource yara_rule behavioral2/memory/3140-121-0x0000000000730000-0x000000000075E000-memory.dmp dave -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\RemoveDeny.tiff 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File renamed C:\Users\Admin\Pictures\RemoveDeny.tiff => C:\Users\Admin\Pictures\RemoveDeny.tiff.YWSCE 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File renamed C:\Users\Admin\Pictures\ResetSkip.crw => C:\Users\Admin\Pictures\ResetSkip.crw.YWSCE 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe -
Drops desktop.ini file(s) 28 IoCs
Processes:
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\Music\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files (x86)\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ppd.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\flavormap.properties 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\meta-index 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\Office16\SLERROR.XML 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\Microsoft Office\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Common Files\Services\verisign.bmp 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-correct.avi 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\Common Files\System\ado\ja-JP\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightRegular.ttf 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\VideoLAN\VLC\locale\az\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Peacock.jpg 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\adcvbs.inc 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\javafx.properties 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.cpl 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ul-oob.xrm-ms 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Stars.jpg 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\VideoLAN\VLC\locale\ml\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File created C:\Program Files\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\readme.txt 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe -
Modifies registry class 18 IoCs
Processes:
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ACE33~1.EXE /p \"%1\"" 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd\ = "DnD.Document" 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd\ShellNew\NullFile 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\open 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\print\command 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\printto 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ACE33~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dnd\ShellNew 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\DefaultIcon 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\printto\command 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\open\command 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\ = "DnD Document" 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ACE33~1.EXE,1" 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ACE33~1.EXE \"%1\"" 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document\shell\print 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DnD.Document 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exepid process 3140 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe 3140 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2320 vssvc.exe Token: SeRestorePrivilege 2320 vssvc.exe Token: SeAuditPrivilege 2320 vssvc.exe Token: SeIncreaseQuotaPrivilege 3572 WMIC.exe Token: SeSecurityPrivilege 3572 WMIC.exe Token: SeTakeOwnershipPrivilege 3572 WMIC.exe Token: SeLoadDriverPrivilege 3572 WMIC.exe Token: SeSystemProfilePrivilege 3572 WMIC.exe Token: SeSystemtimePrivilege 3572 WMIC.exe Token: SeProfSingleProcessPrivilege 3572 WMIC.exe Token: SeIncBasePriorityPrivilege 3572 WMIC.exe Token: SeCreatePagefilePrivilege 3572 WMIC.exe Token: SeBackupPrivilege 3572 WMIC.exe Token: SeRestorePrivilege 3572 WMIC.exe Token: SeShutdownPrivilege 3572 WMIC.exe Token: SeDebugPrivilege 3572 WMIC.exe Token: SeSystemEnvironmentPrivilege 3572 WMIC.exe Token: SeRemoteShutdownPrivilege 3572 WMIC.exe Token: SeUndockPrivilege 3572 WMIC.exe Token: SeManageVolumePrivilege 3572 WMIC.exe Token: 33 3572 WMIC.exe Token: 34 3572 WMIC.exe Token: 35 3572 WMIC.exe Token: 36 3572 WMIC.exe Token: SeIncreaseQuotaPrivilege 3572 WMIC.exe Token: SeSecurityPrivilege 3572 WMIC.exe Token: SeTakeOwnershipPrivilege 3572 WMIC.exe Token: SeLoadDriverPrivilege 3572 WMIC.exe Token: SeSystemProfilePrivilege 3572 WMIC.exe Token: SeSystemtimePrivilege 3572 WMIC.exe Token: SeProfSingleProcessPrivilege 3572 WMIC.exe Token: SeIncBasePriorityPrivilege 3572 WMIC.exe Token: SeCreatePagefilePrivilege 3572 WMIC.exe Token: SeBackupPrivilege 3572 WMIC.exe Token: SeRestorePrivilege 3572 WMIC.exe Token: SeShutdownPrivilege 3572 WMIC.exe Token: SeDebugPrivilege 3572 WMIC.exe Token: SeSystemEnvironmentPrivilege 3572 WMIC.exe Token: SeRemoteShutdownPrivilege 3572 WMIC.exe Token: SeUndockPrivilege 3572 WMIC.exe Token: SeManageVolumePrivilege 3572 WMIC.exe Token: 33 3572 WMIC.exe Token: 34 3572 WMIC.exe Token: 35 3572 WMIC.exe Token: 36 3572 WMIC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exepid process 3140 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe 3140 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.execmd.exedescription pid process target process PID 3140 wrote to memory of 528 3140 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe cmd.exe PID 3140 wrote to memory of 528 3140 5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe cmd.exe PID 528 wrote to memory of 3572 528 cmd.exe WMIC.exe PID 528 wrote to memory of 3572 528 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe"C:\Users\Admin\AppData\Local\Temp\5ace33358a8b11ae52050d02d2d6705f04bd47a27c6c6e28ef65028bbfaf5da9.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B662981-1382-4EE1-B62A-610BFEE02635}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0B662981-1382-4EE1-B62A-610BFEE02635}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320