Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 19:51
Static task
static1
Behavioral task
behavioral1
Sample
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe
Resource
win10v2004-en-20220113
General
-
Target
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe
-
Size
191KB
-
MD5
c8229ecc8b36da53095e489f228acc27
-
SHA1
9febd22b7a953727ce1011055a8c15d1193ab7a3
-
SHA256
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047
-
SHA512
5caba57d5f9dd208a5f5e4e612009f16e2e365197f63aee5713ab76c0f5de48ca535c4dec3dceddf6f22b495aa2a2452c4eb08149e9d0a1704557d02da5e6f24
Malware Config
Extracted
C:\readme.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops desktop.ini file(s) 10 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exedescription ioc process File opened for modification C:\Users\Public\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exedescription ioc process File created C:\Program Files (x86)\Internet Explorer\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Internet Explorer\images\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Common Files\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Mozilla Firefox\platform.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\SelectApprove.odp f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\Windows Sidebar f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\sentinel f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\SyncWatch.tiff f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Common Files\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Microsoft.NET\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\VideoLAN\VLC\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Windows Sidebar f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\descript.ion f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Java\jre7\LICENSE f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Microsoft Games\Purble Place\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\DVD Maker\Shared\Common.fxh f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\HideMeasure.vst f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\DVD Maker\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\7-Zip\Lang\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Microsoft Games\Solitaire\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Internet Explorer\fr-FR\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\Windows Defender f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\History.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Microsoft Games\More Games\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\DisconnectRestore.pptx f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Java\jre7\Welcome.html f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Windows Media Player f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Common Files\microsoft shared\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\RevokePop.dwfx f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Common Files\Services\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Microsoft Games\Mahjong\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Microsoft Office\Office14\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exepid process 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1364 vssvc.exe Token: SeRestorePrivilege 1364 vssvc.exe Token: SeAuditPrivilege 1364 vssvc.exe Token: SeIncreaseQuotaPrivilege 416 WMIC.exe Token: SeSecurityPrivilege 416 WMIC.exe Token: SeTakeOwnershipPrivilege 416 WMIC.exe Token: SeLoadDriverPrivilege 416 WMIC.exe Token: SeSystemProfilePrivilege 416 WMIC.exe Token: SeSystemtimePrivilege 416 WMIC.exe Token: SeProfSingleProcessPrivilege 416 WMIC.exe Token: SeIncBasePriorityPrivilege 416 WMIC.exe Token: SeCreatePagefilePrivilege 416 WMIC.exe Token: SeBackupPrivilege 416 WMIC.exe Token: SeRestorePrivilege 416 WMIC.exe Token: SeShutdownPrivilege 416 WMIC.exe Token: SeDebugPrivilege 416 WMIC.exe Token: SeSystemEnvironmentPrivilege 416 WMIC.exe Token: SeRemoteShutdownPrivilege 416 WMIC.exe Token: SeUndockPrivilege 416 WMIC.exe Token: SeManageVolumePrivilege 416 WMIC.exe Token: 33 416 WMIC.exe Token: 34 416 WMIC.exe Token: 35 416 WMIC.exe Token: SeIncreaseQuotaPrivilege 416 WMIC.exe Token: SeSecurityPrivilege 416 WMIC.exe Token: SeTakeOwnershipPrivilege 416 WMIC.exe Token: SeLoadDriverPrivilege 416 WMIC.exe Token: SeSystemProfilePrivilege 416 WMIC.exe Token: SeSystemtimePrivilege 416 WMIC.exe Token: SeProfSingleProcessPrivilege 416 WMIC.exe Token: SeIncBasePriorityPrivilege 416 WMIC.exe Token: SeCreatePagefilePrivilege 416 WMIC.exe Token: SeBackupPrivilege 416 WMIC.exe Token: SeRestorePrivilege 416 WMIC.exe Token: SeShutdownPrivilege 416 WMIC.exe Token: SeDebugPrivilege 416 WMIC.exe Token: SeSystemEnvironmentPrivilege 416 WMIC.exe Token: SeRemoteShutdownPrivilege 416 WMIC.exe Token: SeUndockPrivilege 416 WMIC.exe Token: SeManageVolumePrivilege 416 WMIC.exe Token: 33 416 WMIC.exe Token: 34 416 WMIC.exe Token: 35 416 WMIC.exe Token: SeIncreaseQuotaPrivilege 1252 WMIC.exe Token: SeSecurityPrivilege 1252 WMIC.exe Token: SeTakeOwnershipPrivilege 1252 WMIC.exe Token: SeLoadDriverPrivilege 1252 WMIC.exe Token: SeSystemProfilePrivilege 1252 WMIC.exe Token: SeSystemtimePrivilege 1252 WMIC.exe Token: SeProfSingleProcessPrivilege 1252 WMIC.exe Token: SeIncBasePriorityPrivilege 1252 WMIC.exe Token: SeCreatePagefilePrivilege 1252 WMIC.exe Token: SeBackupPrivilege 1252 WMIC.exe Token: SeRestorePrivilege 1252 WMIC.exe Token: SeShutdownPrivilege 1252 WMIC.exe Token: SeDebugPrivilege 1252 WMIC.exe Token: SeSystemEnvironmentPrivilege 1252 WMIC.exe Token: SeRemoteShutdownPrivilege 1252 WMIC.exe Token: SeUndockPrivilege 1252 WMIC.exe Token: SeManageVolumePrivilege 1252 WMIC.exe Token: 33 1252 WMIC.exe Token: 34 1252 WMIC.exe Token: 35 1252 WMIC.exe Token: SeIncreaseQuotaPrivilege 1252 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 732 wrote to memory of 1812 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1812 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1812 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1812 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1812 wrote to memory of 416 1812 cmd.exe WMIC.exe PID 1812 wrote to memory of 416 1812 cmd.exe WMIC.exe PID 1812 wrote to memory of 416 1812 cmd.exe WMIC.exe PID 732 wrote to memory of 1804 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1804 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1804 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1804 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1804 wrote to memory of 1252 1804 cmd.exe WMIC.exe PID 1804 wrote to memory of 1252 1804 cmd.exe WMIC.exe PID 1804 wrote to memory of 1252 1804 cmd.exe WMIC.exe PID 732 wrote to memory of 1924 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1924 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1924 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1924 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1924 wrote to memory of 1500 1924 cmd.exe WMIC.exe PID 1924 wrote to memory of 1500 1924 cmd.exe WMIC.exe PID 1924 wrote to memory of 1500 1924 cmd.exe WMIC.exe PID 732 wrote to memory of 792 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 792 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 792 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 792 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 792 wrote to memory of 1900 792 cmd.exe WMIC.exe PID 792 wrote to memory of 1900 792 cmd.exe WMIC.exe PID 792 wrote to memory of 1900 792 cmd.exe WMIC.exe PID 732 wrote to memory of 1756 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1756 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1756 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1756 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1756 wrote to memory of 1692 1756 cmd.exe WMIC.exe PID 1756 wrote to memory of 1692 1756 cmd.exe WMIC.exe PID 1756 wrote to memory of 1692 1756 cmd.exe WMIC.exe PID 732 wrote to memory of 2016 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 2016 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 2016 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 2016 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 2016 wrote to memory of 1008 2016 cmd.exe WMIC.exe PID 2016 wrote to memory of 1008 2016 cmd.exe WMIC.exe PID 2016 wrote to memory of 1008 2016 cmd.exe WMIC.exe PID 732 wrote to memory of 900 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 900 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 900 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 900 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 900 wrote to memory of 2044 900 cmd.exe WMIC.exe PID 900 wrote to memory of 2044 900 cmd.exe WMIC.exe PID 900 wrote to memory of 2044 900 cmd.exe WMIC.exe PID 732 wrote to memory of 1596 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1596 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1596 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1596 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1596 wrote to memory of 1560 1596 cmd.exe WMIC.exe PID 1596 wrote to memory of 1560 1596 cmd.exe WMIC.exe PID 1596 wrote to memory of 1560 1596 cmd.exe WMIC.exe PID 732 wrote to memory of 1600 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1600 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1600 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 732 wrote to memory of 1600 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1600 wrote to memory of 1620 1600 cmd.exe WMIC.exe PID 1600 wrote to memory of 1620 1600 cmd.exe WMIC.exe PID 1600 wrote to memory of 1620 1600 cmd.exe WMIC.exe PID 732 wrote to memory of 1016 732 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe"C:\Users\Admin\AppData\Local\Temp\f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9E6B4C83-E397-4517-8DA9-3484AF0AD84A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9E6B4C83-E397-4517-8DA9-3484AF0AD84A}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:416 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C39B6211-31BD-4714-8535-1220FA86C225}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C39B6211-31BD-4714-8535-1220FA86C225}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00CC08EC-00AD-4AA8-AF16-B3F4F224E56A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00CC08EC-00AD-4AA8-AF16-B3F4F224E56A}'" delete3⤵PID:1500
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B0FF658-0C54-4EB3-9B69-1DA1FB9B2C27}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9B0FF658-0C54-4EB3-9B69-1DA1FB9B2C27}'" delete3⤵PID:1900
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD3219A2-9723-4FB9-975E-9F39890481B3}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BD3219A2-9723-4FB9-975E-9F39890481B3}'" delete3⤵PID:1692
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5106A401-EE5E-40A2-BB45-05B36DB087C7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5106A401-EE5E-40A2-BB45-05B36DB087C7}'" delete3⤵PID:1008
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8183FD06-C119-473D-B4A2-E73D4BF85C63}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8183FD06-C119-473D-B4A2-E73D4BF85C63}'" delete3⤵PID:2044
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AC1A004E-B2DB-49B0-9331-2F2CC053D3DA}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AC1A004E-B2DB-49B0-9331-2F2CC053D3DA}'" delete3⤵PID:1560
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADB940AD-0A35-462E-9FEB-ACC3FC9BC5A1}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ADB940AD-0A35-462E-9FEB-ACC3FC9BC5A1}'" delete3⤵PID:1620
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A2524F2-6C16-47EF-938D-0890A33A8DBA}'" delete2⤵PID:1016
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7A2524F2-6C16-47EF-938D-0890A33A8DBA}'" delete3⤵PID:1340
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{703828D3-18E3-4962-B702-5FA1F0BACDF6}'" delete2⤵PID:1392
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{703828D3-18E3-4962-B702-5FA1F0BACDF6}'" delete3⤵PID:1604
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00AFFCD2-8CEA-41F5-8D20-3B81FD754182}'" delete2⤵PID:1724
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{00AFFCD2-8CEA-41F5-8D20-3B81FD754182}'" delete3⤵PID:2032
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FC5D151-5000-4A63-8B37-619EA4D209F3}'" delete2⤵PID:1904
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FC5D151-5000-4A63-8B37-619EA4D209F3}'" delete3⤵PID:1692
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364