Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
15-02-2022 19:51
Static task
static1
Behavioral task
behavioral1
Sample
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe
Resource
win10v2004-en-20220113
General
-
Target
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe
-
Size
191KB
-
MD5
c8229ecc8b36da53095e489f228acc27
-
SHA1
9febd22b7a953727ce1011055a8c15d1193ab7a3
-
SHA256
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047
-
SHA512
5caba57d5f9dd208a5f5e4e612009f16e2e365197f63aee5713ab76c0f5de48ca535c4dec3dceddf6f22b495aa2a2452c4eb08149e9d0a1704557d02da5e6f24
Malware Config
Extracted
C:\readme.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exedescription ioc process File renamed C:\Users\Admin\Pictures\UndoSet.png => C:\Users\Admin\Pictures\UndoSet.png.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\UnregisterSelect.png => C:\Users\Admin\Pictures\UnregisterSelect.png.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\RequestMeasure.png => C:\Users\Admin\Pictures\RequestMeasure.png.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\ResumeSync.tif => C:\Users\Admin\Pictures\ResumeSync.tif.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\UndoCheckpoint.png => C:\Users\Admin\Pictures\UndoCheckpoint.png.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Pictures\ExportStep.tiff f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\ExportStep.tiff => C:\Users\Admin\Pictures\ExportStep.tiff.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Pictures\LockDismount.tiff f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\LockDismount.tiff => C:\Users\Admin\Pictures\LockDismount.tiff.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\CompleteHide.raw => C:\Users\Admin\Pictures\CompleteHide.raw.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Pictures\ConfirmSend.tiff f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File renamed C:\Users\Admin\Pictures\ConfirmSend.tiff => C:\Users\Admin\Pictures\ConfirmSend.tiff.UHSUM f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe -
Drops desktop.ini file(s) 26 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exedescription ioc process File opened for modification C:\Users\Public\Documents\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\Pictures\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Searches\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Music\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\Music\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\Videos\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Documents\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Links\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Videos\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\Libraries\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\Desktop\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Users\Public\Downloads\desktop.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exedescription ioc process File opened for modification C:\Program Files\SubmitSearch.potx f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\Google\Temp f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\97.0.1072.55\Edge.dat f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-phn.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MML2OMML.XSL f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\ReceiveDisconnect.mpeg f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files (x86)\Google\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.ini f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File created C:\Program Files\Microsoft Office\Office16\readme.txt f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\jsse.jar f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\plugin.jar f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\MountOpen.wm f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe -
Drops file in Windows directory 8 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exepid process 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4840 vssvc.exe Token: SeRestorePrivilege 4840 vssvc.exe Token: SeAuditPrivilege 4840 vssvc.exe Token: SeIncreaseQuotaPrivilege 4928 WMIC.exe Token: SeSecurityPrivilege 4928 WMIC.exe Token: SeTakeOwnershipPrivilege 4928 WMIC.exe Token: SeLoadDriverPrivilege 4928 WMIC.exe Token: SeSystemProfilePrivilege 4928 WMIC.exe Token: SeSystemtimePrivilege 4928 WMIC.exe Token: SeProfSingleProcessPrivilege 4928 WMIC.exe Token: SeIncBasePriorityPrivilege 4928 WMIC.exe Token: SeCreatePagefilePrivilege 4928 WMIC.exe Token: SeBackupPrivilege 4928 WMIC.exe Token: SeRestorePrivilege 4928 WMIC.exe Token: SeShutdownPrivilege 4928 WMIC.exe Token: SeDebugPrivilege 4928 WMIC.exe Token: SeSystemEnvironmentPrivilege 4928 WMIC.exe Token: SeRemoteShutdownPrivilege 4928 WMIC.exe Token: SeUndockPrivilege 4928 WMIC.exe Token: SeManageVolumePrivilege 4928 WMIC.exe Token: 33 4928 WMIC.exe Token: 34 4928 WMIC.exe Token: 35 4928 WMIC.exe Token: 36 4928 WMIC.exe Token: SeIncreaseQuotaPrivilege 4928 WMIC.exe Token: SeSecurityPrivilege 4928 WMIC.exe Token: SeTakeOwnershipPrivilege 4928 WMIC.exe Token: SeLoadDriverPrivilege 4928 WMIC.exe Token: SeSystemProfilePrivilege 4928 WMIC.exe Token: SeSystemtimePrivilege 4928 WMIC.exe Token: SeProfSingleProcessPrivilege 4928 WMIC.exe Token: SeIncBasePriorityPrivilege 4928 WMIC.exe Token: SeCreatePagefilePrivilege 4928 WMIC.exe Token: SeBackupPrivilege 4928 WMIC.exe Token: SeRestorePrivilege 4928 WMIC.exe Token: SeShutdownPrivilege 4928 WMIC.exe Token: SeDebugPrivilege 4928 WMIC.exe Token: SeSystemEnvironmentPrivilege 4928 WMIC.exe Token: SeRemoteShutdownPrivilege 4928 WMIC.exe Token: SeUndockPrivilege 4928 WMIC.exe Token: SeManageVolumePrivilege 4928 WMIC.exe Token: 33 4928 WMIC.exe Token: 34 4928 WMIC.exe Token: 35 4928 WMIC.exe Token: 36 4928 WMIC.exe Token: SeIncreaseQuotaPrivilege 2284 WMIC.exe Token: SeSecurityPrivilege 2284 WMIC.exe Token: SeTakeOwnershipPrivilege 2284 WMIC.exe Token: SeLoadDriverPrivilege 2284 WMIC.exe Token: SeSystemProfilePrivilege 2284 WMIC.exe Token: SeSystemtimePrivilege 2284 WMIC.exe Token: SeProfSingleProcessPrivilege 2284 WMIC.exe Token: SeIncBasePriorityPrivilege 2284 WMIC.exe Token: SeCreatePagefilePrivilege 2284 WMIC.exe Token: SeBackupPrivilege 2284 WMIC.exe Token: SeRestorePrivilege 2284 WMIC.exe Token: SeShutdownPrivilege 2284 WMIC.exe Token: SeDebugPrivilege 2284 WMIC.exe Token: SeSystemEnvironmentPrivilege 2284 WMIC.exe Token: SeRemoteShutdownPrivilege 2284 WMIC.exe Token: SeUndockPrivilege 2284 WMIC.exe Token: SeManageVolumePrivilege 2284 WMIC.exe Token: 33 2284 WMIC.exe Token: 34 2284 WMIC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.execmd.execmd.exedescription pid process target process PID 1956 wrote to memory of 4160 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1956 wrote to memory of 4160 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 4160 wrote to memory of 4928 4160 cmd.exe WMIC.exe PID 4160 wrote to memory of 4928 4160 cmd.exe WMIC.exe PID 1956 wrote to memory of 1332 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1956 wrote to memory of 1332 1956 f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe cmd.exe PID 1332 wrote to memory of 2284 1332 cmd.exe WMIC.exe PID 1332 wrote to memory of 2284 1332 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe"C:\Users\Admin\AppData\Local\Temp\f848c62dbc910ee32990161cc598f550707d26c524394be35c7bdb7a62626047.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{17C5A010-80A0-4F9A-836F-BFCB14B6316C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{17C5A010-80A0-4F9A-836F-BFCB14B6316C}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4928 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E9B5643F-8908-41A9-879A-BF3F65E24DF9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E9B5643F-8908-41A9-879A-BF3F65E24DF9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
PID:888
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
PID:1936