Analysis
-
max time kernel
166s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
15-02-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe
Resource
win10v2004-en-20220112
General
-
Target
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe
-
Size
194KB
-
MD5
8d85f4b07a54c561d0f20df4d7f60a64
-
SHA1
115e74ce685019f32990e881e169f7d77f062c45
-
SHA256
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012
-
SHA512
82660c14193ac9a434fd2237458ddcde3466ba4784ccdc6f8c2604007a85a492bb8ad8e154bdfbcc7387f1310e2d919acd3d0a4b6aab8d68a4f49938144ed6bb
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.ws
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 64 IoCs
Processes:
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exedescription ioc process File opened for modification C:\Program Files\OutSync.docx e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\blocklist.xml e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\release e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Uninstall Information\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Java\jdk1.8.0_66\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\UsePush.aifc e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\VideoLAN\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Google\Policies\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Internet Explorer\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\VideoLAN\VLC\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Common Files\Adobe\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Microsoft Office 15\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Google\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files\Common Files\DESIGNER\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Common Files\Services\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\RequestEnable.mpg e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\descript.ion e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\VideoLAN\VLC\THANKS.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\readme.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Edge.dat.LOG1 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\RenameInvoke.001 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.exeTiWorker.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 50 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4208" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.299402" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4224" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132896048123060390" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.947866" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exepid process 3488 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe 3488 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeTiWorker.exedescription pid process Token: SeBackupPrivilege 3968 vssvc.exe Token: SeRestorePrivilege 3968 vssvc.exe Token: SeAuditPrivilege 3968 vssvc.exe Token: SeIncreaseQuotaPrivilege 312 WMIC.exe Token: SeSecurityPrivilege 312 WMIC.exe Token: SeTakeOwnershipPrivilege 312 WMIC.exe Token: SeLoadDriverPrivilege 312 WMIC.exe Token: SeSystemProfilePrivilege 312 WMIC.exe Token: SeSystemtimePrivilege 312 WMIC.exe Token: SeProfSingleProcessPrivilege 312 WMIC.exe Token: SeIncBasePriorityPrivilege 312 WMIC.exe Token: SeCreatePagefilePrivilege 312 WMIC.exe Token: SeBackupPrivilege 312 WMIC.exe Token: SeRestorePrivilege 312 WMIC.exe Token: SeShutdownPrivilege 312 WMIC.exe Token: SeDebugPrivilege 312 WMIC.exe Token: SeSystemEnvironmentPrivilege 312 WMIC.exe Token: SeRemoteShutdownPrivilege 312 WMIC.exe Token: SeUndockPrivilege 312 WMIC.exe Token: SeManageVolumePrivilege 312 WMIC.exe Token: 33 312 WMIC.exe Token: 34 312 WMIC.exe Token: 35 312 WMIC.exe Token: 36 312 WMIC.exe Token: SeIncreaseQuotaPrivilege 312 WMIC.exe Token: SeSecurityPrivilege 312 WMIC.exe Token: SeTakeOwnershipPrivilege 312 WMIC.exe Token: SeLoadDriverPrivilege 312 WMIC.exe Token: SeSystemProfilePrivilege 312 WMIC.exe Token: SeSystemtimePrivilege 312 WMIC.exe Token: SeProfSingleProcessPrivilege 312 WMIC.exe Token: SeIncBasePriorityPrivilege 312 WMIC.exe Token: SeCreatePagefilePrivilege 312 WMIC.exe Token: SeBackupPrivilege 312 WMIC.exe Token: SeRestorePrivilege 312 WMIC.exe Token: SeShutdownPrivilege 312 WMIC.exe Token: SeDebugPrivilege 312 WMIC.exe Token: SeSystemEnvironmentPrivilege 312 WMIC.exe Token: SeRemoteShutdownPrivilege 312 WMIC.exe Token: SeUndockPrivilege 312 WMIC.exe Token: SeManageVolumePrivilege 312 WMIC.exe Token: 33 312 WMIC.exe Token: 34 312 WMIC.exe Token: 35 312 WMIC.exe Token: 36 312 WMIC.exe Token: SeSecurityPrivilege 2124 TiWorker.exe Token: SeRestorePrivilege 2124 TiWorker.exe Token: SeBackupPrivilege 2124 TiWorker.exe Token: SeBackupPrivilege 2124 TiWorker.exe Token: SeRestorePrivilege 2124 TiWorker.exe Token: SeSecurityPrivilege 2124 TiWorker.exe Token: SeBackupPrivilege 2124 TiWorker.exe Token: SeRestorePrivilege 2124 TiWorker.exe Token: SeSecurityPrivilege 2124 TiWorker.exe Token: SeBackupPrivilege 2124 TiWorker.exe Token: SeRestorePrivilege 2124 TiWorker.exe Token: SeSecurityPrivilege 2124 TiWorker.exe Token: SeBackupPrivilege 2124 TiWorker.exe Token: SeRestorePrivilege 2124 TiWorker.exe Token: SeSecurityPrivilege 2124 TiWorker.exe Token: SeBackupPrivilege 2124 TiWorker.exe Token: SeRestorePrivilege 2124 TiWorker.exe Token: SeSecurityPrivilege 2124 TiWorker.exe Token: SeBackupPrivilege 2124 TiWorker.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.execmd.exedescription pid process target process PID 3488 wrote to memory of 1792 3488 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 3488 wrote to memory of 1792 3488 e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe cmd.exe PID 1792 wrote to memory of 312 1792 cmd.exe WMIC.exe PID 1792 wrote to memory of 312 1792 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe"C:\Users\Admin\AppData\Local\Temp\e532662996409a0f959353768936d95444ffee71d5f14536d603e031f183b012.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8D84F5DF-167E-44BC-B65F-610B82C3B339}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8D84F5DF-167E-44BC-B65F-610B82C3B339}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:312
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3740
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2752
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2124