Analysis
-
max time kernel
153s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe
Resource
win10v2004-en-20220112
General
-
Target
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe
-
Size
190KB
-
MD5
2cf6ead51641c507bd8e159e5f8fde04
-
SHA1
e65e0d2cea2d27bb10960200359829cd814b6a68
-
SHA256
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045
-
SHA512
0903a5a85bbbe95e26f585ec3ee0560c8a6cb7403942a18da6b5ebaff67b430dc5afb0e00b7ed61425d07834d42517cdc98622332e4ee493145707079fca2d65
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exedescription ioc process File renamed C:\Users\Admin\Pictures\ExportTest.png => C:\Users\Admin\Pictures\ExportTest.png.FEALC e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File renamed C:\Users\Admin\Pictures\ExportWait.raw => C:\Users\Admin\Pictures\ExportWait.raw.FEALC e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File renamed C:\Users\Admin\Pictures\UninstallSelect.tif => C:\Users\Admin\Pictures\UninstallSelect.tif.FEALC e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe -
Drops desktop.ini file(s) 31 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exedescription ioc process File opened for modification C:\Users\Public\Videos\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Links\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\Music\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Searches\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\Documents\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Music\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152696.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187815.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\VideoLAN\VLC\New_Skins.url e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Games\More Games\de-DE\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Composite.thmx e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186362.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00146_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106146.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152698.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy.jar e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107282.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107364.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185796.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Adjacency.thmx e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVCMP.DIC e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153089.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Java\jre7\LICENSE e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jawt.lib e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0197979.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\DVD Maker\Shared\Parity.fx e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00448_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00235_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresslm.dat e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090027.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185786.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107308.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00440_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00443_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153313.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD20013_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Mozilla Firefox\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195342.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Games\Minesweeper\es-ES\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\handler.reg e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Common Files\SpeechEngines\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Games\Solitaire\en-US\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exepid process 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 1332 vssvc.exe Token: SeRestorePrivilege 1332 vssvc.exe Token: SeAuditPrivilege 1332 vssvc.exe Token: SeIncreaseQuotaPrivilege 1112 WMIC.exe Token: SeSecurityPrivilege 1112 WMIC.exe Token: SeTakeOwnershipPrivilege 1112 WMIC.exe Token: SeLoadDriverPrivilege 1112 WMIC.exe Token: SeSystemProfilePrivilege 1112 WMIC.exe Token: SeSystemtimePrivilege 1112 WMIC.exe Token: SeProfSingleProcessPrivilege 1112 WMIC.exe Token: SeIncBasePriorityPrivilege 1112 WMIC.exe Token: SeCreatePagefilePrivilege 1112 WMIC.exe Token: SeBackupPrivilege 1112 WMIC.exe Token: SeRestorePrivilege 1112 WMIC.exe Token: SeShutdownPrivilege 1112 WMIC.exe Token: SeDebugPrivilege 1112 WMIC.exe Token: SeSystemEnvironmentPrivilege 1112 WMIC.exe Token: SeRemoteShutdownPrivilege 1112 WMIC.exe Token: SeUndockPrivilege 1112 WMIC.exe Token: SeManageVolumePrivilege 1112 WMIC.exe Token: 33 1112 WMIC.exe Token: 34 1112 WMIC.exe Token: 35 1112 WMIC.exe Token: SeIncreaseQuotaPrivilege 1112 WMIC.exe Token: SeSecurityPrivilege 1112 WMIC.exe Token: SeTakeOwnershipPrivilege 1112 WMIC.exe Token: SeLoadDriverPrivilege 1112 WMIC.exe Token: SeSystemProfilePrivilege 1112 WMIC.exe Token: SeSystemtimePrivilege 1112 WMIC.exe Token: SeProfSingleProcessPrivilege 1112 WMIC.exe Token: SeIncBasePriorityPrivilege 1112 WMIC.exe Token: SeCreatePagefilePrivilege 1112 WMIC.exe Token: SeBackupPrivilege 1112 WMIC.exe Token: SeRestorePrivilege 1112 WMIC.exe Token: SeShutdownPrivilege 1112 WMIC.exe Token: SeDebugPrivilege 1112 WMIC.exe Token: SeSystemEnvironmentPrivilege 1112 WMIC.exe Token: SeRemoteShutdownPrivilege 1112 WMIC.exe Token: SeUndockPrivilege 1112 WMIC.exe Token: SeManageVolumePrivilege 1112 WMIC.exe Token: 33 1112 WMIC.exe Token: 34 1112 WMIC.exe Token: 35 1112 WMIC.exe Token: SeIncreaseQuotaPrivilege 1956 WMIC.exe Token: SeSecurityPrivilege 1956 WMIC.exe Token: SeTakeOwnershipPrivilege 1956 WMIC.exe Token: SeLoadDriverPrivilege 1956 WMIC.exe Token: SeSystemProfilePrivilege 1956 WMIC.exe Token: SeSystemtimePrivilege 1956 WMIC.exe Token: SeProfSingleProcessPrivilege 1956 WMIC.exe Token: SeIncBasePriorityPrivilege 1956 WMIC.exe Token: SeCreatePagefilePrivilege 1956 WMIC.exe Token: SeBackupPrivilege 1956 WMIC.exe Token: SeRestorePrivilege 1956 WMIC.exe Token: SeShutdownPrivilege 1956 WMIC.exe Token: SeDebugPrivilege 1956 WMIC.exe Token: SeSystemEnvironmentPrivilege 1956 WMIC.exe Token: SeRemoteShutdownPrivilege 1956 WMIC.exe Token: SeUndockPrivilege 1956 WMIC.exe Token: SeManageVolumePrivilege 1956 WMIC.exe Token: 33 1956 WMIC.exe Token: 34 1956 WMIC.exe Token: 35 1956 WMIC.exe Token: SeIncreaseQuotaPrivilege 1956 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 288 wrote to memory of 1168 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1168 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1168 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1168 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1168 wrote to memory of 1112 1168 cmd.exe WMIC.exe PID 1168 wrote to memory of 1112 1168 cmd.exe WMIC.exe PID 1168 wrote to memory of 1112 1168 cmd.exe WMIC.exe PID 288 wrote to memory of 1992 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1992 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1992 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1992 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1992 wrote to memory of 1956 1992 cmd.exe WMIC.exe PID 1992 wrote to memory of 1956 1992 cmd.exe WMIC.exe PID 1992 wrote to memory of 1956 1992 cmd.exe WMIC.exe PID 288 wrote to memory of 1488 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1488 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1488 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1488 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1488 wrote to memory of 2008 1488 cmd.exe WMIC.exe PID 1488 wrote to memory of 2008 1488 cmd.exe WMIC.exe PID 1488 wrote to memory of 2008 1488 cmd.exe WMIC.exe PID 288 wrote to memory of 1000 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1000 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1000 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1000 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1000 wrote to memory of 996 1000 cmd.exe WMIC.exe PID 1000 wrote to memory of 996 1000 cmd.exe WMIC.exe PID 1000 wrote to memory of 996 1000 cmd.exe WMIC.exe PID 288 wrote to memory of 1632 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1632 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1632 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1632 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1632 wrote to memory of 1484 1632 cmd.exe WMIC.exe PID 1632 wrote to memory of 1484 1632 cmd.exe WMIC.exe PID 1632 wrote to memory of 1484 1632 cmd.exe WMIC.exe PID 288 wrote to memory of 1056 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1056 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1056 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1056 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1056 wrote to memory of 1920 1056 cmd.exe WMIC.exe PID 1056 wrote to memory of 1920 1056 cmd.exe WMIC.exe PID 1056 wrote to memory of 1920 1056 cmd.exe WMIC.exe PID 288 wrote to memory of 1240 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1240 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1240 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1240 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1240 wrote to memory of 1744 1240 cmd.exe WMIC.exe PID 1240 wrote to memory of 1744 1240 cmd.exe WMIC.exe PID 1240 wrote to memory of 1744 1240 cmd.exe WMIC.exe PID 288 wrote to memory of 1716 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1716 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1716 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1716 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1716 wrote to memory of 1596 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 1596 1716 cmd.exe WMIC.exe PID 1716 wrote to memory of 1596 1716 cmd.exe WMIC.exe PID 288 wrote to memory of 1156 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1156 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1156 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 288 wrote to memory of 1156 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1156 wrote to memory of 1976 1156 cmd.exe WMIC.exe PID 1156 wrote to memory of 1976 1156 cmd.exe WMIC.exe PID 1156 wrote to memory of 1976 1156 cmd.exe WMIC.exe PID 288 wrote to memory of 1540 288 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe"C:\Users\Admin\AppData\Local\Temp\e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete3⤵PID:2008
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete3⤵PID:996
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete3⤵PID:1484
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete3⤵PID:1920
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete3⤵PID:1744
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete3⤵PID:1596
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete3⤵PID:1976
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete2⤵PID:1540
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete3⤵PID:1492
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete2⤵PID:1968
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete3⤵PID:1636
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete2⤵PID:1616
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete3⤵PID:1624
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete2⤵PID:1164
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete3⤵PID:1328
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1332