Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe
Resource
win10v2004-en-20220112
General
-
Target
e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe
-
Size
195KB
-
MD5
652979601b3d6fbb54883cecb0cc03f7
-
SHA1
7961c041dd54965363a7513fbde2aec071d74c5a
-
SHA256
e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e
-
SHA512
1e56d198b5728376057eb5461978172a41c18315f823d7699601aa6f1d28a51cef3a3a953e91d4bc0822bc3d19a409ab71a110bfad06d283a46173317df4f108
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\AssertUse.tif e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\7-Zip\7z.sfx e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\DVD Maker\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\Microsoft Games\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\PushTrace.gif e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\offset.ax e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\Mozilla Firefox\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\VideoLAN\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DisableRequest.cr2 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DisconnectGrant.ttf e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\InstallConvertFrom.mp4v e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\ReadPop.doc e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\7-Zip\License.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\Uninstall Information\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\SwitchImport.mpa e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\7-Zip\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\directshowtap.ax e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Adobe\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\UpdateFind.dwfx e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\WriteUnpublish.cr2 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\7-Zip\descript.ion e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\Reference Assemblies\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\MSBuild\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\SwitchStep.scf e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\Microsoft Office\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\PingHide.xltm e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\Google\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\CompressAssert.iso e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\SubmitWatch.vdx e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\MSBuild\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Common Files\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\SaveExpand.wpl e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\UnregisterBlock.pub e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\FindRemove.vdx e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\PushOpen.3gp2 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File created C:\Program Files\Internet Explorer\readme.txt e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exepid process 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 576 vssvc.exe Token: SeRestorePrivilege 576 vssvc.exe Token: SeAuditPrivilege 576 vssvc.exe Token: SeIncreaseQuotaPrivilege 1200 WMIC.exe Token: SeSecurityPrivilege 1200 WMIC.exe Token: SeTakeOwnershipPrivilege 1200 WMIC.exe Token: SeLoadDriverPrivilege 1200 WMIC.exe Token: SeSystemProfilePrivilege 1200 WMIC.exe Token: SeSystemtimePrivilege 1200 WMIC.exe Token: SeProfSingleProcessPrivilege 1200 WMIC.exe Token: SeIncBasePriorityPrivilege 1200 WMIC.exe Token: SeCreatePagefilePrivilege 1200 WMIC.exe Token: SeBackupPrivilege 1200 WMIC.exe Token: SeRestorePrivilege 1200 WMIC.exe Token: SeShutdownPrivilege 1200 WMIC.exe Token: SeDebugPrivilege 1200 WMIC.exe Token: SeSystemEnvironmentPrivilege 1200 WMIC.exe Token: SeRemoteShutdownPrivilege 1200 WMIC.exe Token: SeUndockPrivilege 1200 WMIC.exe Token: SeManageVolumePrivilege 1200 WMIC.exe Token: 33 1200 WMIC.exe Token: 34 1200 WMIC.exe Token: 35 1200 WMIC.exe Token: SeIncreaseQuotaPrivilege 1200 WMIC.exe Token: SeSecurityPrivilege 1200 WMIC.exe Token: SeTakeOwnershipPrivilege 1200 WMIC.exe Token: SeLoadDriverPrivilege 1200 WMIC.exe Token: SeSystemProfilePrivilege 1200 WMIC.exe Token: SeSystemtimePrivilege 1200 WMIC.exe Token: SeProfSingleProcessPrivilege 1200 WMIC.exe Token: SeIncBasePriorityPrivilege 1200 WMIC.exe Token: SeCreatePagefilePrivilege 1200 WMIC.exe Token: SeBackupPrivilege 1200 WMIC.exe Token: SeRestorePrivilege 1200 WMIC.exe Token: SeShutdownPrivilege 1200 WMIC.exe Token: SeDebugPrivilege 1200 WMIC.exe Token: SeSystemEnvironmentPrivilege 1200 WMIC.exe Token: SeRemoteShutdownPrivilege 1200 WMIC.exe Token: SeUndockPrivilege 1200 WMIC.exe Token: SeManageVolumePrivilege 1200 WMIC.exe Token: 33 1200 WMIC.exe Token: 34 1200 WMIC.exe Token: 35 1200 WMIC.exe Token: SeIncreaseQuotaPrivilege 1164 WMIC.exe Token: SeSecurityPrivilege 1164 WMIC.exe Token: SeTakeOwnershipPrivilege 1164 WMIC.exe Token: SeLoadDriverPrivilege 1164 WMIC.exe Token: SeSystemProfilePrivilege 1164 WMIC.exe Token: SeSystemtimePrivilege 1164 WMIC.exe Token: SeProfSingleProcessPrivilege 1164 WMIC.exe Token: SeIncBasePriorityPrivilege 1164 WMIC.exe Token: SeCreatePagefilePrivilege 1164 WMIC.exe Token: SeBackupPrivilege 1164 WMIC.exe Token: SeRestorePrivilege 1164 WMIC.exe Token: SeShutdownPrivilege 1164 WMIC.exe Token: SeDebugPrivilege 1164 WMIC.exe Token: SeSystemEnvironmentPrivilege 1164 WMIC.exe Token: SeRemoteShutdownPrivilege 1164 WMIC.exe Token: SeUndockPrivilege 1164 WMIC.exe Token: SeManageVolumePrivilege 1164 WMIC.exe Token: 33 1164 WMIC.exe Token: 34 1164 WMIC.exe Token: 35 1164 WMIC.exe Token: SeIncreaseQuotaPrivilege 1164 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1260 wrote to memory of 1704 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1704 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1704 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1704 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1704 wrote to memory of 1200 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 1200 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 1200 1704 cmd.exe WMIC.exe PID 1260 wrote to memory of 1160 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1160 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1160 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1160 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1160 wrote to memory of 1164 1160 cmd.exe WMIC.exe PID 1160 wrote to memory of 1164 1160 cmd.exe WMIC.exe PID 1160 wrote to memory of 1164 1160 cmd.exe WMIC.exe PID 1260 wrote to memory of 1488 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1488 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1488 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1488 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1488 wrote to memory of 1220 1488 cmd.exe WMIC.exe PID 1488 wrote to memory of 1220 1488 cmd.exe WMIC.exe PID 1488 wrote to memory of 1220 1488 cmd.exe WMIC.exe PID 1260 wrote to memory of 1548 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1548 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1548 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1548 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1548 wrote to memory of 1624 1548 cmd.exe WMIC.exe PID 1548 wrote to memory of 1624 1548 cmd.exe WMIC.exe PID 1548 wrote to memory of 1624 1548 cmd.exe WMIC.exe PID 1260 wrote to memory of 1924 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1924 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1924 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1924 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1924 wrote to memory of 1772 1924 cmd.exe WMIC.exe PID 1924 wrote to memory of 1772 1924 cmd.exe WMIC.exe PID 1924 wrote to memory of 1772 1924 cmd.exe WMIC.exe PID 1260 wrote to memory of 1748 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1748 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1748 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 1748 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1748 wrote to memory of 1916 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1916 1748 cmd.exe WMIC.exe PID 1748 wrote to memory of 1916 1748 cmd.exe WMIC.exe PID 1260 wrote to memory of 388 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 388 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 388 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 388 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 388 wrote to memory of 896 388 cmd.exe WMIC.exe PID 388 wrote to memory of 896 388 cmd.exe WMIC.exe PID 388 wrote to memory of 896 388 cmd.exe WMIC.exe PID 1260 wrote to memory of 2020 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 2020 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 2020 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 2020 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 2020 wrote to memory of 1604 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1604 2020 cmd.exe WMIC.exe PID 2020 wrote to memory of 1604 2020 cmd.exe WMIC.exe PID 1260 wrote to memory of 824 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 824 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 824 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 1260 wrote to memory of 824 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe PID 824 wrote to memory of 396 824 cmd.exe WMIC.exe PID 824 wrote to memory of 396 824 cmd.exe WMIC.exe PID 824 wrote to memory of 396 824 cmd.exe WMIC.exe PID 1260 wrote to memory of 1012 1260 e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe"C:\Users\Admin\AppData\Local\Temp\e58dde6a12fa539480a9e2d6f8342a7942703027969d396c19f1acffadcf284e.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete3⤵PID:1220
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete3⤵PID:1624
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete3⤵PID:1772
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete3⤵PID:1916
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete3⤵PID:896
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete3⤵PID:1604
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete3⤵PID:396
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete2⤵PID:1012
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete3⤵PID:968
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete2⤵PID:1160
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete3⤵PID:612
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete2⤵PID:1500
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete3⤵PID:1844
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete2⤵PID:1192
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete3⤵PID:928
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:576