Analysis
-
max time kernel
166s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efc8f8172303ff78d207b2eb8c78511e.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
efc8f8172303ff78d207b2eb8c78511e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
efc8f8172303ff78d207b2eb8c78511e.exe
-
Size
195KB
-
MD5
efc8f8172303ff78d207b2eb8c78511e
-
SHA1
bdf1d7e889905e4df8485fc7dfbb9bdfb91e676e
-
SHA256
7fbeac1dca907f4c04fec45a1228c9277f03930355eeac30d101bbce7e2733de
-
SHA512
056d2289776db4f7ede6076d5e932e9641f3885f6096c022a7d1d06662881d7bb464d3a0605c5b40e50175541d5b370f814a4c2900b9172156161b43a8bb7d67
-
SSDEEP
3072:6a/EBc2jrORnQssIJZYKcgtHhGk528yJKY8/d7epmB98g89QP2EKOjWk:7EBc2jMQsdJdBgHJ+/dB9rP2sR
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI strain.
As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.
To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.xyz/
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.
---BEGIN ID---
ZNBmQgFGbXCmtCB0aaZmMTpHL2YtecUgu6blxIMU12WwvHaAt0PdnKmkdK1zz4PQ
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (99) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\UninstallSync.ogg efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\WaitGroup.docx efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Internet Explorer\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Microsoft Analysis Services\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\SuspendProtect.001 efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Google\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\ApproveReset.vsdm efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\BackupComplete.xla efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\7-Zip\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Common Files\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Mozilla Firefox\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\NewConvert.scf efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\RequestExport.odt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\7-Zip\descript.ion efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Uninstall Information\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\RestartStep.odp efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\TraceDebug.tiff efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\7-Zip\History.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Java\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\SearchConvert.aifc efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Microsoft Games\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\FormatClear.kix efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Adobe\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\Reference Assemblies\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Microsoft Sync Framework\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files\VideoLAN\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\GetConvertTo.kix efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\UnlockApprove.bmp efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml efc8f8172303ff78d207b2eb8c78511e.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\DisableExit.vstm efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\EnableRename.wmx efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\ExportDisable.vsdm efc8f8172303ff78d207b2eb8c78511e.exe File opened for modification C:\Program Files\WatchSplit.php efc8f8172303ff78d207b2eb8c78511e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1888 efc8f8172303ff78d207b2eb8c78511e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2712 vssvc.exe Token: SeRestorePrivilege 2712 vssvc.exe Token: SeAuditPrivilege 2712 vssvc.exe Token: SeIncreaseQuotaPrivilege 2820 WMIC.exe Token: SeSecurityPrivilege 2820 WMIC.exe Token: SeTakeOwnershipPrivilege 2820 WMIC.exe Token: SeLoadDriverPrivilege 2820 WMIC.exe Token: SeSystemProfilePrivilege 2820 WMIC.exe Token: SeSystemtimePrivilege 2820 WMIC.exe Token: SeProfSingleProcessPrivilege 2820 WMIC.exe Token: SeIncBasePriorityPrivilege 2820 WMIC.exe Token: SeCreatePagefilePrivilege 2820 WMIC.exe Token: SeBackupPrivilege 2820 WMIC.exe Token: SeRestorePrivilege 2820 WMIC.exe Token: SeShutdownPrivilege 2820 WMIC.exe Token: SeDebugPrivilege 2820 WMIC.exe Token: SeSystemEnvironmentPrivilege 2820 WMIC.exe Token: SeRemoteShutdownPrivilege 2820 WMIC.exe Token: SeUndockPrivilege 2820 WMIC.exe Token: SeManageVolumePrivilege 2820 WMIC.exe Token: 33 2820 WMIC.exe Token: 34 2820 WMIC.exe Token: 35 2820 WMIC.exe Token: SeIncreaseQuotaPrivilege 2820 WMIC.exe Token: SeSecurityPrivilege 2820 WMIC.exe Token: SeTakeOwnershipPrivilege 2820 WMIC.exe Token: SeLoadDriverPrivilege 2820 WMIC.exe Token: SeSystemProfilePrivilege 2820 WMIC.exe Token: SeSystemtimePrivilege 2820 WMIC.exe Token: SeProfSingleProcessPrivilege 2820 WMIC.exe Token: SeIncBasePriorityPrivilege 2820 WMIC.exe Token: SeCreatePagefilePrivilege 2820 WMIC.exe Token: SeBackupPrivilege 2820 WMIC.exe Token: SeRestorePrivilege 2820 WMIC.exe Token: SeShutdownPrivilege 2820 WMIC.exe Token: SeDebugPrivilege 2820 WMIC.exe Token: SeSystemEnvironmentPrivilege 2820 WMIC.exe Token: SeRemoteShutdownPrivilege 2820 WMIC.exe Token: SeUndockPrivilege 2820 WMIC.exe Token: SeManageVolumePrivilege 2820 WMIC.exe Token: 33 2820 WMIC.exe Token: 34 2820 WMIC.exe Token: 35 2820 WMIC.exe Token: SeIncreaseQuotaPrivilege 3036 WMIC.exe Token: SeSecurityPrivilege 3036 WMIC.exe Token: SeTakeOwnershipPrivilege 3036 WMIC.exe Token: SeLoadDriverPrivilege 3036 WMIC.exe Token: SeSystemProfilePrivilege 3036 WMIC.exe Token: SeSystemtimePrivilege 3036 WMIC.exe Token: SeProfSingleProcessPrivilege 3036 WMIC.exe Token: SeIncBasePriorityPrivilege 3036 WMIC.exe Token: SeCreatePagefilePrivilege 3036 WMIC.exe Token: SeBackupPrivilege 3036 WMIC.exe Token: SeRestorePrivilege 3036 WMIC.exe Token: SeShutdownPrivilege 3036 WMIC.exe Token: SeDebugPrivilege 3036 WMIC.exe Token: SeSystemEnvironmentPrivilege 3036 WMIC.exe Token: SeRemoteShutdownPrivilege 3036 WMIC.exe Token: SeUndockPrivilege 3036 WMIC.exe Token: SeManageVolumePrivilege 3036 WMIC.exe Token: 33 3036 WMIC.exe Token: 34 3036 WMIC.exe Token: 35 3036 WMIC.exe Token: SeIncreaseQuotaPrivilege 3036 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2720 1888 efc8f8172303ff78d207b2eb8c78511e.exe 33 PID 1888 wrote to memory of 2720 1888 efc8f8172303ff78d207b2eb8c78511e.exe 33 PID 1888 wrote to memory of 2720 1888 efc8f8172303ff78d207b2eb8c78511e.exe 33 PID 1888 wrote to memory of 2720 1888 efc8f8172303ff78d207b2eb8c78511e.exe 33 PID 2720 wrote to memory of 2820 2720 cmd.exe 34 PID 2720 wrote to memory of 2820 2720 cmd.exe 34 PID 2720 wrote to memory of 2820 2720 cmd.exe 34 PID 1888 wrote to memory of 2624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 37 PID 1888 wrote to memory of 2624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 37 PID 1888 wrote to memory of 2624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 37 PID 1888 wrote to memory of 2624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 37 PID 2624 wrote to memory of 3036 2624 cmd.exe 36 PID 2624 wrote to memory of 3036 2624 cmd.exe 36 PID 2624 wrote to memory of 3036 2624 cmd.exe 36 PID 1888 wrote to memory of 3044 1888 efc8f8172303ff78d207b2eb8c78511e.exe 39 PID 1888 wrote to memory of 3044 1888 efc8f8172303ff78d207b2eb8c78511e.exe 39 PID 1888 wrote to memory of 3044 1888 efc8f8172303ff78d207b2eb8c78511e.exe 39 PID 1888 wrote to memory of 3044 1888 efc8f8172303ff78d207b2eb8c78511e.exe 39 PID 3044 wrote to memory of 732 3044 cmd.exe 40 PID 3044 wrote to memory of 732 3044 cmd.exe 40 PID 3044 wrote to memory of 732 3044 cmd.exe 40 PID 1888 wrote to memory of 1192 1888 efc8f8172303ff78d207b2eb8c78511e.exe 41 PID 1888 wrote to memory of 1192 1888 efc8f8172303ff78d207b2eb8c78511e.exe 41 PID 1888 wrote to memory of 1192 1888 efc8f8172303ff78d207b2eb8c78511e.exe 41 PID 1888 wrote to memory of 1192 1888 efc8f8172303ff78d207b2eb8c78511e.exe 41 PID 1192 wrote to memory of 340 1192 cmd.exe 43 PID 1192 wrote to memory of 340 1192 cmd.exe 43 PID 1192 wrote to memory of 340 1192 cmd.exe 43 PID 1888 wrote to memory of 1452 1888 efc8f8172303ff78d207b2eb8c78511e.exe 45 PID 1888 wrote to memory of 1452 1888 efc8f8172303ff78d207b2eb8c78511e.exe 45 PID 1888 wrote to memory of 1452 1888 efc8f8172303ff78d207b2eb8c78511e.exe 45 PID 1888 wrote to memory of 1452 1888 efc8f8172303ff78d207b2eb8c78511e.exe 45 PID 1452 wrote to memory of 2288 1452 cmd.exe 46 PID 1452 wrote to memory of 2288 1452 cmd.exe 46 PID 1452 wrote to memory of 2288 1452 cmd.exe 46 PID 1888 wrote to memory of 1932 1888 efc8f8172303ff78d207b2eb8c78511e.exe 47 PID 1888 wrote to memory of 1932 1888 efc8f8172303ff78d207b2eb8c78511e.exe 47 PID 1888 wrote to memory of 1932 1888 efc8f8172303ff78d207b2eb8c78511e.exe 47 PID 1888 wrote to memory of 1932 1888 efc8f8172303ff78d207b2eb8c78511e.exe 47 PID 1932 wrote to memory of 536 1932 cmd.exe 49 PID 1932 wrote to memory of 536 1932 cmd.exe 49 PID 1932 wrote to memory of 536 1932 cmd.exe 49 PID 1888 wrote to memory of 1336 1888 efc8f8172303ff78d207b2eb8c78511e.exe 50 PID 1888 wrote to memory of 1336 1888 efc8f8172303ff78d207b2eb8c78511e.exe 50 PID 1888 wrote to memory of 1336 1888 efc8f8172303ff78d207b2eb8c78511e.exe 50 PID 1888 wrote to memory of 1336 1888 efc8f8172303ff78d207b2eb8c78511e.exe 50 PID 1336 wrote to memory of 1976 1336 cmd.exe 52 PID 1336 wrote to memory of 1976 1336 cmd.exe 52 PID 1336 wrote to memory of 1976 1336 cmd.exe 52 PID 1888 wrote to memory of 2176 1888 efc8f8172303ff78d207b2eb8c78511e.exe 53 PID 1888 wrote to memory of 2176 1888 efc8f8172303ff78d207b2eb8c78511e.exe 53 PID 1888 wrote to memory of 2176 1888 efc8f8172303ff78d207b2eb8c78511e.exe 53 PID 1888 wrote to memory of 2176 1888 efc8f8172303ff78d207b2eb8c78511e.exe 53 PID 2176 wrote to memory of 312 2176 cmd.exe 55 PID 2176 wrote to memory of 312 2176 cmd.exe 55 PID 2176 wrote to memory of 312 2176 cmd.exe 55 PID 1888 wrote to memory of 1624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 56 PID 1888 wrote to memory of 1624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 56 PID 1888 wrote to memory of 1624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 56 PID 1888 wrote to memory of 1624 1888 efc8f8172303ff78d207b2eb8c78511e.exe 56 PID 1624 wrote to memory of 1632 1624 cmd.exe 58 PID 1624 wrote to memory of 1632 1624 cmd.exe 58 PID 1624 wrote to memory of 1632 1624 cmd.exe 58 PID 1888 wrote to memory of 1516 1888 efc8f8172303ff78d207b2eb8c78511e.exe 59 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc8f8172303ff78d207b2eb8c78511e.exe"C:\Users\Admin\AppData\Local\Temp\efc8f8172303ff78d207b2eb8c78511e.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4D04C29-A1FE-41D5-98FE-5C8E7089033A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4D04C29-A1FE-41D5-98FE-5C8E7089033A}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{37B54C89-EA09-4296-AED8-5A5E4503F7C0}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2624
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8EA09C7F-C218-4A29-A3E5-19D47ED23247}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8EA09C7F-C218-4A29-A3E5-19D47ED23247}'" delete3⤵PID:732
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DE12628E-02AD-4E7B-9127-C7EEC56BFF63}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DE12628E-02AD-4E7B-9127-C7EEC56BFF63}'" delete3⤵PID:340
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{198CF6A9-CB0E-4622-9DB0-7668C9B414A2}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{198CF6A9-CB0E-4622-9DB0-7668C9B414A2}'" delete3⤵PID:2288
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{769A0221-6861-4054-92AE-5F47490F6F0E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{769A0221-6861-4054-92AE-5F47490F6F0E}'" delete3⤵PID:536
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8A5A4DC1-1D9D-4A94-8BE7-11A2B0353E8E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8A5A4DC1-1D9D-4A94-8BE7-11A2B0353E8E}'" delete3⤵PID:1976
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{793B0E60-6EEF-4395-98DE-73CE16790E14}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{793B0E60-6EEF-4395-98DE-73CE16790E14}'" delete3⤵PID:312
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9A3CBCD9-B5A4-4374-921C-FF5624C804E4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9A3CBCD9-B5A4-4374-921C-FF5624C804E4}'" delete3⤵PID:1632
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CCB4A5CA-8BCD-4DDE-B509-23292065C894}'" delete2⤵PID:1516
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CCB4A5CA-8BCD-4DDE-B509-23292065C894}'" delete3⤵PID:2776
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DBA45E00-EEEF-438D-83AE-276D6A3BD687}'" delete2⤵PID:2652
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DBA45E00-EEEF-438D-83AE-276D6A3BD687}'" delete3⤵PID:2296
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{50A67248-6012-496D-847F-63B736C23053}'" delete2⤵PID:2060
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{50A67248-6012-496D-847F-63B736C23053}'" delete3⤵PID:1212
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A4C069B-6FB1-4EF3-B997-3A9E91EAE496}'" delete2⤵PID:2320
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A4C069B-6FB1-4EF3-B997-3A9E91EAE496}'" delete3⤵PID:1152
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{17681E6F-CA70-42F7-9DD1-32FEBF600900}'" delete2⤵PID:2984
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{17681E6F-CA70-42F7-9DD1-32FEBF600900}'" delete3⤵PID:436
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{94B46605-CF63-49F2-905E-87939A0B4B65}'" delete2⤵PID:1540
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{94B46605-CF63-49F2-905E-87939A0B4B65}'" delete3⤵PID:1896
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C0BF523-3C69-48D3-AC18-3BF3139BFAA5}'" delete2⤵PID:2648
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C0BF523-3C69-48D3-AC18-3BF3139BFAA5}'" delete3⤵PID:1612
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97E8C192-18C6-47E7-9127-23E70F4C3397}'" delete2⤵PID:2120
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97E8C192-18C6-47E7-9127-23E70F4C3397}'" delete3⤵PID:1636
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73994912-8F8B-45EA-885D-2D931455ED0E}'" delete2⤵PID:2168
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73994912-8F8B-45EA-885D-2D931455ED0E}'" delete3⤵PID:2220
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{37B54C89-EA09-4296-AED8-5A5E4503F7C0}'" delete1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50fcf534007952d7d5b15dcb256af5f26
SHA1ef9032bfdc14226fae860602fb45d3b9d70086a6
SHA256f872f34286d027bc229b27bceb753a8b7f6920a5891e3f5f9e1b50a4d0d279d1
SHA51217c74fa73663e9d236b3c77da668cd11202dca10ca059c22f6e6594b1111cb7116d4ae2ad0b0556dd9056a0b29866060bb84299660f253e816266692e60e013f