Analysis
-
max time kernel
163s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
15-02-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe
Resource
win10v2004-en-20220112
General
-
Target
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe
-
Size
190KB
-
MD5
2cf6ead51641c507bd8e159e5f8fde04
-
SHA1
e65e0d2cea2d27bb10960200359829cd814b6a68
-
SHA256
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045
-
SHA512
0903a5a85bbbe95e26f585ec3ee0560c8a6cb7403942a18da6b5ebaff67b430dc5afb0e00b7ed61425d07834d42517cdc98622332e4ee493145707079fca2d65
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops desktop.ini file(s) 3 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exedescription ioc process File opened for modification C:\Program Files\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Users\Public\desktop.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe -
Drops file in Program Files directory 64 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exedescription ioc process File opened for modification C:\Program Files\Windows Multimedia Platform e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Internet Explorer\fr-FR\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Office\Office16\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Mozilla Firefox\browser\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Windows NT e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Windows Sidebar e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files (x86)\Internet Explorer\it-IT\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\WindowsApps e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Java\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Office\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Internet Explorer\en-US\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Office 15\ClientX64\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\SplitExit.clr e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Windows Mail e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Google\Temp e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Windows NT e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Internet Explorer\SIGNUP\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\OpenAdd.pptx e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Edge.dat e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Common Files\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files (x86)\Google\Update\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files (x86)\Internet Explorer\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\SendBackup.midi e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Office\Updates\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Java\jdk1.8.0_66\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files\Microsoft Office\root\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\7z.sfx e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe File created C:\Program Files (x86)\Google\Policies\readme.txt e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4180" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4268" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.272835" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.260994" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132896048980285387" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exepid process 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 2284 vssvc.exe Token: SeRestorePrivilege 2284 vssvc.exe Token: SeAuditPrivilege 2284 vssvc.exe Token: SeIncreaseQuotaPrivilege 3884 WMIC.exe Token: SeSecurityPrivilege 3884 WMIC.exe Token: SeTakeOwnershipPrivilege 3884 WMIC.exe Token: SeLoadDriverPrivilege 3884 WMIC.exe Token: SeSystemProfilePrivilege 3884 WMIC.exe Token: SeSystemtimePrivilege 3884 WMIC.exe Token: SeProfSingleProcessPrivilege 3884 WMIC.exe Token: SeIncBasePriorityPrivilege 3884 WMIC.exe Token: SeCreatePagefilePrivilege 3884 WMIC.exe Token: SeBackupPrivilege 3884 WMIC.exe Token: SeRestorePrivilege 3884 WMIC.exe Token: SeShutdownPrivilege 3884 WMIC.exe Token: SeDebugPrivilege 3884 WMIC.exe Token: SeSystemEnvironmentPrivilege 3884 WMIC.exe Token: SeRemoteShutdownPrivilege 3884 WMIC.exe Token: SeUndockPrivilege 3884 WMIC.exe Token: SeManageVolumePrivilege 3884 WMIC.exe Token: 33 3884 WMIC.exe Token: 34 3884 WMIC.exe Token: 35 3884 WMIC.exe Token: 36 3884 WMIC.exe Token: SeIncreaseQuotaPrivilege 3884 WMIC.exe Token: SeSecurityPrivilege 3884 WMIC.exe Token: SeTakeOwnershipPrivilege 3884 WMIC.exe Token: SeLoadDriverPrivilege 3884 WMIC.exe Token: SeSystemProfilePrivilege 3884 WMIC.exe Token: SeSystemtimePrivilege 3884 WMIC.exe Token: SeProfSingleProcessPrivilege 3884 WMIC.exe Token: SeIncBasePriorityPrivilege 3884 WMIC.exe Token: SeCreatePagefilePrivilege 3884 WMIC.exe Token: SeBackupPrivilege 3884 WMIC.exe Token: SeRestorePrivilege 3884 WMIC.exe Token: SeShutdownPrivilege 3884 WMIC.exe Token: SeDebugPrivilege 3884 WMIC.exe Token: SeSystemEnvironmentPrivilege 3884 WMIC.exe Token: SeRemoteShutdownPrivilege 3884 WMIC.exe Token: SeUndockPrivilege 3884 WMIC.exe Token: SeManageVolumePrivilege 3884 WMIC.exe Token: 33 3884 WMIC.exe Token: 34 3884 WMIC.exe Token: 35 3884 WMIC.exe Token: 36 3884 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.execmd.exedescription pid process target process PID 1532 wrote to memory of 1308 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1532 wrote to memory of 1308 1532 e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe cmd.exe PID 1308 wrote to memory of 3884 1308 cmd.exe WMIC.exe PID 1308 wrote to memory of 3884 1308 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe"C:\Users\Admin\AppData\Local\Temp\e30779c98cc860a022ea2b144176f73387b7306160445c351fbb4de9133db045.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8D84F5DF-167E-44BC-B65F-610B82C3B339}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8D84F5DF-167E-44BC-B65F-610B82C3B339}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:1956
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3120