Analysis
-
max time kernel
154s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 19:51
Static task
static1
Behavioral task
behavioral1
Sample
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe
Resource
win10v2004-en-20220113
General
-
Target
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe
-
Size
195KB
-
MD5
c684ea612f487efd1f4088dc126cc83d
-
SHA1
95ad974c8e2ecd5bcb49872b86ea358ae307d32c
-
SHA256
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c
-
SHA512
d76f900a1e9ae8bfd4afe7ad1fd9dfb15b30d2873f93afb17567b2ff9e1af9444252213aded05484c51f645911819f378245b1edf4a2d12153b02672a35d8863
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exedescription ioc process File opened for modification C:\Program Files\DenyFind.jtx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\SetExpand.odt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\StepSelect.cfg f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\MSBuild\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\ConvertFromMove.001 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\directshowtap.ax f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Internet Explorer\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\VideoLAN\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Google\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\FormatSearch.pptx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\RestartOpen.vsdm f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DenyRevoke.7z f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Microsoft Office\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\RegisterExpand.001 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\License.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\ExportSkip.cab f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\RemoveClear.vsd f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\RepairReset.gif f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\SendWatch.odt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\MountExpand.vstx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\JoinImport.wav f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\SaveRepair.au3 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Uninstall Information\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Common Files\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Microsoft Sync Framework\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\ConvertFromRestart.wpl f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\SubmitTest.php f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\descript.ion f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Google\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\NewResume.wm f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\DVD Maker\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Java\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\CompletePush.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\7-Zip\History.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DVD Maker\offset.ax f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Mozilla Firefox\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\UsePublish.search-ms f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\DisconnectPop.mpeg3 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\SkipPop.wpl f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files\Microsoft Games\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe File opened for modification C:\Program Files\CopySearch.mov f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exepid process 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 872 vssvc.exe Token: SeRestorePrivilege 872 vssvc.exe Token: SeAuditPrivilege 872 vssvc.exe Token: SeIncreaseQuotaPrivilege 1108 WMIC.exe Token: SeSecurityPrivilege 1108 WMIC.exe Token: SeTakeOwnershipPrivilege 1108 WMIC.exe Token: SeLoadDriverPrivilege 1108 WMIC.exe Token: SeSystemProfilePrivilege 1108 WMIC.exe Token: SeSystemtimePrivilege 1108 WMIC.exe Token: SeProfSingleProcessPrivilege 1108 WMIC.exe Token: SeIncBasePriorityPrivilege 1108 WMIC.exe Token: SeCreatePagefilePrivilege 1108 WMIC.exe Token: SeBackupPrivilege 1108 WMIC.exe Token: SeRestorePrivilege 1108 WMIC.exe Token: SeShutdownPrivilege 1108 WMIC.exe Token: SeDebugPrivilege 1108 WMIC.exe Token: SeSystemEnvironmentPrivilege 1108 WMIC.exe Token: SeRemoteShutdownPrivilege 1108 WMIC.exe Token: SeUndockPrivilege 1108 WMIC.exe Token: SeManageVolumePrivilege 1108 WMIC.exe Token: 33 1108 WMIC.exe Token: 34 1108 WMIC.exe Token: 35 1108 WMIC.exe Token: SeIncreaseQuotaPrivilege 1108 WMIC.exe Token: SeSecurityPrivilege 1108 WMIC.exe Token: SeTakeOwnershipPrivilege 1108 WMIC.exe Token: SeLoadDriverPrivilege 1108 WMIC.exe Token: SeSystemProfilePrivilege 1108 WMIC.exe Token: SeSystemtimePrivilege 1108 WMIC.exe Token: SeProfSingleProcessPrivilege 1108 WMIC.exe Token: SeIncBasePriorityPrivilege 1108 WMIC.exe Token: SeCreatePagefilePrivilege 1108 WMIC.exe Token: SeBackupPrivilege 1108 WMIC.exe Token: SeRestorePrivilege 1108 WMIC.exe Token: SeShutdownPrivilege 1108 WMIC.exe Token: SeDebugPrivilege 1108 WMIC.exe Token: SeSystemEnvironmentPrivilege 1108 WMIC.exe Token: SeRemoteShutdownPrivilege 1108 WMIC.exe Token: SeUndockPrivilege 1108 WMIC.exe Token: SeManageVolumePrivilege 1108 WMIC.exe Token: 33 1108 WMIC.exe Token: 34 1108 WMIC.exe Token: 35 1108 WMIC.exe Token: SeIncreaseQuotaPrivilege 1932 WMIC.exe Token: SeSecurityPrivilege 1932 WMIC.exe Token: SeTakeOwnershipPrivilege 1932 WMIC.exe Token: SeLoadDriverPrivilege 1932 WMIC.exe Token: SeSystemProfilePrivilege 1932 WMIC.exe Token: SeSystemtimePrivilege 1932 WMIC.exe Token: SeProfSingleProcessPrivilege 1932 WMIC.exe Token: SeIncBasePriorityPrivilege 1932 WMIC.exe Token: SeCreatePagefilePrivilege 1932 WMIC.exe Token: SeBackupPrivilege 1932 WMIC.exe Token: SeRestorePrivilege 1932 WMIC.exe Token: SeShutdownPrivilege 1932 WMIC.exe Token: SeDebugPrivilege 1932 WMIC.exe Token: SeSystemEnvironmentPrivilege 1932 WMIC.exe Token: SeRemoteShutdownPrivilege 1932 WMIC.exe Token: SeUndockPrivilege 1932 WMIC.exe Token: SeManageVolumePrivilege 1932 WMIC.exe Token: 33 1932 WMIC.exe Token: 34 1932 WMIC.exe Token: 35 1932 WMIC.exe Token: SeIncreaseQuotaPrivilege 1932 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1088 wrote to memory of 1376 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1376 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1376 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1376 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1376 wrote to memory of 1108 1376 cmd.exe WMIC.exe PID 1376 wrote to memory of 1108 1376 cmd.exe WMIC.exe PID 1376 wrote to memory of 1108 1376 cmd.exe WMIC.exe PID 1088 wrote to memory of 1972 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1972 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1972 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1972 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1972 wrote to memory of 1932 1972 cmd.exe WMIC.exe PID 1972 wrote to memory of 1932 1972 cmd.exe WMIC.exe PID 1972 wrote to memory of 1932 1972 cmd.exe WMIC.exe PID 1088 wrote to memory of 1696 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1696 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1696 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1696 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1696 wrote to memory of 1716 1696 cmd.exe WMIC.exe PID 1696 wrote to memory of 1716 1696 cmd.exe WMIC.exe PID 1696 wrote to memory of 1716 1696 cmd.exe WMIC.exe PID 1088 wrote to memory of 1296 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1296 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1296 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1296 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1296 wrote to memory of 1004 1296 cmd.exe WMIC.exe PID 1296 wrote to memory of 1004 1296 cmd.exe WMIC.exe PID 1296 wrote to memory of 1004 1296 cmd.exe WMIC.exe PID 1088 wrote to memory of 1704 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1704 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1704 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1704 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1704 wrote to memory of 1772 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 1772 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 1772 1704 cmd.exe WMIC.exe PID 1088 wrote to memory of 1476 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1476 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1476 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1476 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1476 wrote to memory of 1356 1476 cmd.exe WMIC.exe PID 1476 wrote to memory of 1356 1476 cmd.exe WMIC.exe PID 1476 wrote to memory of 1356 1476 cmd.exe WMIC.exe PID 1088 wrote to memory of 1736 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1736 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1736 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1736 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1736 wrote to memory of 1524 1736 cmd.exe WMIC.exe PID 1736 wrote to memory of 1524 1736 cmd.exe WMIC.exe PID 1736 wrote to memory of 1524 1736 cmd.exe WMIC.exe PID 1088 wrote to memory of 1164 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1164 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1164 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 1164 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1164 wrote to memory of 1588 1164 cmd.exe WMIC.exe PID 1164 wrote to memory of 1588 1164 cmd.exe WMIC.exe PID 1164 wrote to memory of 1588 1164 cmd.exe WMIC.exe PID 1088 wrote to memory of 976 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 976 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 976 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 1088 wrote to memory of 976 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe PID 976 wrote to memory of 1992 976 cmd.exe WMIC.exe PID 976 wrote to memory of 1992 976 cmd.exe WMIC.exe PID 976 wrote to memory of 1992 976 cmd.exe WMIC.exe PID 1088 wrote to memory of 1884 1088 f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe"C:\Users\Admin\AppData\Local\Temp\f99c69327a746f4fde02b7a550cf6c9f48e5e22fcb49bea0e3e4bc5a3efa605c.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1108 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete3⤵PID:1716
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete3⤵PID:1004
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete3⤵PID:1772
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete3⤵PID:1356
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete3⤵PID:1524
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete3⤵PID:1588
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete3⤵PID:1992
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete2⤵PID:1884
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete3⤵PID:1552
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete2⤵PID:1072
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete3⤵PID:1008
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete2⤵PID:1732
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete3⤵PID:1988
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete2⤵PID:1244
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete3⤵PID:2012
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:872