Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe
Resource
win10v2004-en-20220112
General
-
Target
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe
-
Size
194KB
-
MD5
8d85f4b07a54c561d0f20df4d7f60a64
-
SHA1
115e74ce685019f32990e881e169f7d77f062c45
-
SHA256
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012
-
SHA512
82660c14193ac9a434fd2237458ddcde3466ba4784ccdc6f8c2604007a85a492bb8ad8e154bdfbcc7387f1310e2d919acd3d0a4b6aab8d68a4f49938144ed6bb
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.ws
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\CompareCopy.tiff e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File renamed C:\Users\Admin\Pictures\CompareCopy.tiff => C:\Users\Admin\Pictures\CompareCopy.tiff.JCVID e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Users\Admin\Pictures\OpenAssert.tiff e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File renamed C:\Users\Admin\Pictures\OpenAssert.tiff => C:\Users\Admin\Pictures\OpenAssert.tiff.JCVID e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0197979.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Urban.thmx e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107722.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153302.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238927.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Mozilla Firefox\browser\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02298_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099149.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199303.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341654.JPG e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0089945.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152698.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188519.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00538_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\MSBuild\Microsoft\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Java\jre7\lib\resources.jar e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0252669.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239941.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187817.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\handsafe.reg e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212685.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Couture.thmx e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Google\Chrome\Application\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Common Files\System\de-DE\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.HLP e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Microsoft Games\Minesweeper\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01013_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212601.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Internet Explorer\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0281632.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02407_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\VideoLAN\VLC\lua\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00921_.WMF e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313896.JPG e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exepid process 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 560 vssvc.exe Token: SeRestorePrivilege 560 vssvc.exe Token: SeAuditPrivilege 560 vssvc.exe Token: SeIncreaseQuotaPrivilege 1652 WMIC.exe Token: SeSecurityPrivilege 1652 WMIC.exe Token: SeTakeOwnershipPrivilege 1652 WMIC.exe Token: SeLoadDriverPrivilege 1652 WMIC.exe Token: SeSystemProfilePrivilege 1652 WMIC.exe Token: SeSystemtimePrivilege 1652 WMIC.exe Token: SeProfSingleProcessPrivilege 1652 WMIC.exe Token: SeIncBasePriorityPrivilege 1652 WMIC.exe Token: SeCreatePagefilePrivilege 1652 WMIC.exe Token: SeBackupPrivilege 1652 WMIC.exe Token: SeRestorePrivilege 1652 WMIC.exe Token: SeShutdownPrivilege 1652 WMIC.exe Token: SeDebugPrivilege 1652 WMIC.exe Token: SeSystemEnvironmentPrivilege 1652 WMIC.exe Token: SeRemoteShutdownPrivilege 1652 WMIC.exe Token: SeUndockPrivilege 1652 WMIC.exe Token: SeManageVolumePrivilege 1652 WMIC.exe Token: 33 1652 WMIC.exe Token: 34 1652 WMIC.exe Token: 35 1652 WMIC.exe Token: SeIncreaseQuotaPrivilege 1652 WMIC.exe Token: SeSecurityPrivilege 1652 WMIC.exe Token: SeTakeOwnershipPrivilege 1652 WMIC.exe Token: SeLoadDriverPrivilege 1652 WMIC.exe Token: SeSystemProfilePrivilege 1652 WMIC.exe Token: SeSystemtimePrivilege 1652 WMIC.exe Token: SeProfSingleProcessPrivilege 1652 WMIC.exe Token: SeIncBasePriorityPrivilege 1652 WMIC.exe Token: SeCreatePagefilePrivilege 1652 WMIC.exe Token: SeBackupPrivilege 1652 WMIC.exe Token: SeRestorePrivilege 1652 WMIC.exe Token: SeShutdownPrivilege 1652 WMIC.exe Token: SeDebugPrivilege 1652 WMIC.exe Token: SeSystemEnvironmentPrivilege 1652 WMIC.exe Token: SeRemoteShutdownPrivilege 1652 WMIC.exe Token: SeUndockPrivilege 1652 WMIC.exe Token: SeManageVolumePrivilege 1652 WMIC.exe Token: 33 1652 WMIC.exe Token: 34 1652 WMIC.exe Token: 35 1652 WMIC.exe Token: SeIncreaseQuotaPrivilege 968 WMIC.exe Token: SeSecurityPrivilege 968 WMIC.exe Token: SeTakeOwnershipPrivilege 968 WMIC.exe Token: SeLoadDriverPrivilege 968 WMIC.exe Token: SeSystemProfilePrivilege 968 WMIC.exe Token: SeSystemtimePrivilege 968 WMIC.exe Token: SeProfSingleProcessPrivilege 968 WMIC.exe Token: SeIncBasePriorityPrivilege 968 WMIC.exe Token: SeCreatePagefilePrivilege 968 WMIC.exe Token: SeBackupPrivilege 968 WMIC.exe Token: SeRestorePrivilege 968 WMIC.exe Token: SeShutdownPrivilege 968 WMIC.exe Token: SeDebugPrivilege 968 WMIC.exe Token: SeSystemEnvironmentPrivilege 968 WMIC.exe Token: SeRemoteShutdownPrivilege 968 WMIC.exe Token: SeUndockPrivilege 968 WMIC.exe Token: SeManageVolumePrivilege 968 WMIC.exe Token: 33 968 WMIC.exe Token: 34 968 WMIC.exe Token: 35 968 WMIC.exe Token: SeIncreaseQuotaPrivilege 968 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1308 wrote to memory of 240 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 240 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 240 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 240 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 240 wrote to memory of 1652 240 cmd.exe WMIC.exe PID 240 wrote to memory of 1652 240 cmd.exe WMIC.exe PID 240 wrote to memory of 1652 240 cmd.exe WMIC.exe PID 1308 wrote to memory of 844 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 844 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 844 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 844 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 844 wrote to memory of 968 844 cmd.exe WMIC.exe PID 844 wrote to memory of 968 844 cmd.exe WMIC.exe PID 844 wrote to memory of 968 844 cmd.exe WMIC.exe PID 1308 wrote to memory of 1616 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1616 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1616 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1616 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1616 wrote to memory of 1928 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1928 1616 cmd.exe WMIC.exe PID 1616 wrote to memory of 1928 1616 cmd.exe WMIC.exe PID 1308 wrote to memory of 1124 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1124 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1124 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1124 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1124 wrote to memory of 1016 1124 cmd.exe WMIC.exe PID 1124 wrote to memory of 1016 1124 cmd.exe WMIC.exe PID 1124 wrote to memory of 1016 1124 cmd.exe WMIC.exe PID 1308 wrote to memory of 1716 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1716 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1716 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1716 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1716 wrote to memory of 1692 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 1692 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 1692 1716 cmd.exe WMIC.exe PID 1308 wrote to memory of 940 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 940 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 940 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 940 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 940 wrote to memory of 1956 940 cmd.exe WMIC.exe PID 940 wrote to memory of 1956 940 cmd.exe WMIC.exe PID 940 wrote to memory of 1956 940 cmd.exe WMIC.exe PID 1308 wrote to memory of 1952 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1952 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1952 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1952 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1952 wrote to memory of 596 1952 cmd.exe WMIC.exe PID 1952 wrote to memory of 596 1952 cmd.exe WMIC.exe PID 1952 wrote to memory of 596 1952 cmd.exe WMIC.exe PID 1308 wrote to memory of 1576 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1576 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1576 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 1576 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1576 wrote to memory of 2028 1576 cmd.exe WMIC.exe PID 1576 wrote to memory of 2028 1576 cmd.exe WMIC.exe PID 1576 wrote to memory of 2028 1576 cmd.exe WMIC.exe PID 1308 wrote to memory of 840 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 840 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 840 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1308 wrote to memory of 840 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 840 wrote to memory of 1836 840 cmd.exe WMIC.exe PID 840 wrote to memory of 1836 840 cmd.exe WMIC.exe PID 840 wrote to memory of 1836 840 cmd.exe WMIC.exe PID 1308 wrote to memory of 1020 1308 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe"C:\Users\Admin\AppData\Local\Temp\e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete3⤵PID:1928
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete3⤵PID:1016
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete3⤵PID:1692
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete3⤵PID:1956
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete3⤵PID:596
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete3⤵PID:2028
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete3⤵PID:1836
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete2⤵PID:1020
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete3⤵PID:1604
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete2⤵PID:740
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete3⤵PID:1284
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete2⤵PID:1360
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete3⤵PID:1532
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete2⤵PID:1720
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete3⤵PID:2040
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560