Overview
overview
10Static
static
10075F9A8B9A...C5.exe
windows7-x64
1075F9A8B9A...C5.exe
windows10-2004-x64
1145F7ABE9A...EA.exe
windows7-x64
10145F7ABE9A...EA.exe
windows10-2004-x64
101A99AC759F...31.exe
windows7-x64
31A99AC759F...31.exe
windows10-2004-x64
31BE33E4291...2D.exe
windows7-x64
101BE33E4291...2D.exe
windows10-2004-x64
102188BAE387...0C.dll
windows7-x64
32188BAE387...0C.dll
windows10-2004-x64
322F524ABC9...92.exe
windows7-x64
1022F524ABC9...92.exe
windows10-2004-x64
1033381793BD...5E.exe
windows7-x64
133381793BD...5E.exe
windows10-2004-x64
161C0810A23...A1.exe
windows7-x64
161C0810A23...A1.exe
windows10-2004-x64
1676A2A0D88...CB.exe
windows7-x64
7676A2A0D88...CB.exe
windows10-2004-x64
773D29DEAC4...09.exe
windows7-x64
173D29DEAC4...09.exe
windows10-2004-x64
181EFD50EB3...29.exe
windows7-x64
781EFD50EB3...29.exe
windows10-2004-x64
78E83C0F656...07.exe
windows7-x64
108E83C0F656...07.exe
windows10-2004-x64
1099CA9F3245...E2.exe
windows7-x64
599CA9F3245...E2.exe
windows10-2004-x64
5B1E12D0216...06.exe
windows7-x64
10B1E12D0216...06.exe
windows10-2004-x64
10C6185A23C5...C8.exe
windows7-x64
10C6185A23C5...C8.exe
windows10-2004-x64
10CDCFEDDB0A...3E.exe
windows7-x64
10CDCFEDDB0A...3E.exe
windows10-2004-x64
10Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-01-2024 14:20
Behavioral task
behavioral1
Sample
075F9A8B9A5A3F3C221CFA69BA8B3590CFB873946970B7F3DBD333A580D24AC5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
075F9A8B9A5A3F3C221CFA69BA8B3590CFB873946970B7F3DBD333A580D24AC5.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
145F7ABE9ABFFD0422F1C1F4CF429E89FD9D3BE93E6C3A0DD852DB708992C4EA.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
145F7ABE9ABFFD0422F1C1F4CF429E89FD9D3BE93E6C3A0DD852DB708992C4EA.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
1A99AC759FCD881729B76C2904476B4201E794DF2D0547C954EA37BE7C153131.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
1A99AC759FCD881729B76C2904476B4201E794DF2D0547C954EA37BE7C153131.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
1BE33E42910515D58685E4CEE83C4C9B7DE4E6A155A6FD936922682A9922D42D.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
1BE33E42910515D58685E4CEE83C4C9B7DE4E6A155A6FD936922682A9922D42D.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
2188BAE387FD2665D807D0B67B916973478CBE417D2042A146C8EADF77AF600C.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
2188BAE387FD2665D807D0B67B916973478CBE417D2042A146C8EADF77AF600C.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
33381793BD156716647F2C2E14047AA5559E940FF584D3FF6110B96EB701115E.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
33381793BD156716647F2C2E14047AA5559E940FF584D3FF6110B96EB701115E.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
61C0810A23580CF492A6BA4F7654566108331E7A4134C968C2D6A05261B2D8A1.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
61C0810A23580CF492A6BA4F7654566108331E7A4134C968C2D6A05261B2D8A1.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
676A2A0D88A79012300A63092DA090F5B0D0BDFC105541732254E0AE1FEB2FCB.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
676A2A0D88A79012300A63092DA090F5B0D0BDFC105541732254E0AE1FEB2FCB.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
73D29DEAC41E022CE77730F74D5EFB0828F56D1F2BEB91FD24ABC867F851FE09.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
73D29DEAC41E022CE77730F74D5EFB0828F56D1F2BEB91FD24ABC867F851FE09.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
81EFD50EB374AD2176E2655AF10276079F733C0592E83E3A044253DCBE06F329.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
81EFD50EB374AD2176E2655AF10276079F733C0592E83E3A044253DCBE06F329.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
8E83C0F6566169AF1CF6C28670DCEE6EDEB15D0913AA24AD3831C9F97EB42307.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
8E83C0F6566169AF1CF6C28670DCEE6EDEB15D0913AA24AD3831C9F97EB42307.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
99CA9F3245265C2F9D395B4B3A8554056E481C6FEE98B839C9C5ADB5B79E0DE2.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
99CA9F3245265C2F9D395B4B3A8554056E481C6FEE98B839C9C5ADB5B79E0DE2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
C6185A23C51B8AC77E6C1BDF2CD4A8D39B02AF8B8027D4162CF9766D19CF87C8.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
C6185A23C51B8AC77E6C1BDF2CD4A8D39B02AF8B8027D4162CF9766D19CF87C8.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
CDCFEDDB0ACA42E65E6A4822C1F23DF7C4AE92775EBCC0B45D4160B732B0983E.exe
Resource
win7-20231215-en
General
-
Target
B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe
-
Size
231KB
-
MD5
5e3ec333a0b2ccf85fcc8ef31c1c8caa
-
SHA1
e6d9b00dd20426fb3d3a2c9a77b86553c144986a
-
SHA256
b1e12d0216a946329fe549e09bf481d7df9e8e3bc3f99bc24d9940cbb8f76f06
-
SHA512
116737b153810a7b2f91e52a03e97fa0601735919ec219aebff5e74321c730d14bbb46f5bcff457587daafd5c8c9341964d1ac91bc171b96f8289e02b0f370f7
-
SSDEEP
3072:ge9f4GwJqzPG927z6r7JGSxS0S4/J2cux2Ut8q7frsFmm0xUMZByH:z9fkgzP4HQSxSuJ2c/AnUmxxUGByH
Malware Config
Extracted
C:\Program Files (x86)\!!!-Restore-My-Files-!!!.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (7894) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Searches\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Music\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\C8HX303O\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Music\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Documents\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Downloads\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Videos\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Documents\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Desktop\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\UBTYURA7\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Videos\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\592Q329J\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HSCYP491\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Links\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Libraries\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Users\Public\Pictures\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\et.pak B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Macau B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\PREVIEW.GIF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UTC B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Triedit\de-DE\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTL.ICO B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Noronha B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099152.JPG B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01154_.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_EN.LEX B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Verve.eftx B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301480.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ENVELOPE.DPV B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files\Java\jre7\lib\amd64\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSWORD.OLB B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287408.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01176_.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImagesMask.bmp B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01213K.JPG B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00018_.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB5A.BDR B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WPULQT98.POC B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\PROCDB.XLAM B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\AST4 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086428.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00720_.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.GIF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImages.jpg B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHPHN.DAT B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15170_.GIF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File created C:\Program Files (x86)\Google\Update\Install\!!!-Restore-My-Files-!!!.txt B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_ON.GIF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00523_.WMF B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2832 vssvc.exe Token: SeRestorePrivilege 2832 vssvc.exe Token: SeAuditPrivilege 2832 vssvc.exe Token: SeIncreaseQuotaPrivilege 2800 WMIC.exe Token: SeSecurityPrivilege 2800 WMIC.exe Token: SeTakeOwnershipPrivilege 2800 WMIC.exe Token: SeLoadDriverPrivilege 2800 WMIC.exe Token: SeSystemProfilePrivilege 2800 WMIC.exe Token: SeSystemtimePrivilege 2800 WMIC.exe Token: SeProfSingleProcessPrivilege 2800 WMIC.exe Token: SeIncBasePriorityPrivilege 2800 WMIC.exe Token: SeCreatePagefilePrivilege 2800 WMIC.exe Token: SeBackupPrivilege 2800 WMIC.exe Token: SeRestorePrivilege 2800 WMIC.exe Token: SeShutdownPrivilege 2800 WMIC.exe Token: SeDebugPrivilege 2800 WMIC.exe Token: SeSystemEnvironmentPrivilege 2800 WMIC.exe Token: SeRemoteShutdownPrivilege 2800 WMIC.exe Token: SeUndockPrivilege 2800 WMIC.exe Token: SeManageVolumePrivilege 2800 WMIC.exe Token: 33 2800 WMIC.exe Token: 34 2800 WMIC.exe Token: 35 2800 WMIC.exe Token: SeIncreaseQuotaPrivilege 2800 WMIC.exe Token: SeSecurityPrivilege 2800 WMIC.exe Token: SeTakeOwnershipPrivilege 2800 WMIC.exe Token: SeLoadDriverPrivilege 2800 WMIC.exe Token: SeSystemProfilePrivilege 2800 WMIC.exe Token: SeSystemtimePrivilege 2800 WMIC.exe Token: SeProfSingleProcessPrivilege 2800 WMIC.exe Token: SeIncBasePriorityPrivilege 2800 WMIC.exe Token: SeCreatePagefilePrivilege 2800 WMIC.exe Token: SeBackupPrivilege 2800 WMIC.exe Token: SeRestorePrivilege 2800 WMIC.exe Token: SeShutdownPrivilege 2800 WMIC.exe Token: SeDebugPrivilege 2800 WMIC.exe Token: SeSystemEnvironmentPrivilege 2800 WMIC.exe Token: SeRemoteShutdownPrivilege 2800 WMIC.exe Token: SeUndockPrivilege 2800 WMIC.exe Token: SeManageVolumePrivilege 2800 WMIC.exe Token: 33 2800 WMIC.exe Token: 34 2800 WMIC.exe Token: 35 2800 WMIC.exe Token: SeIncreaseQuotaPrivilege 2604 WMIC.exe Token: SeSecurityPrivilege 2604 WMIC.exe Token: SeTakeOwnershipPrivilege 2604 WMIC.exe Token: SeLoadDriverPrivilege 2604 WMIC.exe Token: SeSystemProfilePrivilege 2604 WMIC.exe Token: SeSystemtimePrivilege 2604 WMIC.exe Token: SeProfSingleProcessPrivilege 2604 WMIC.exe Token: SeIncBasePriorityPrivilege 2604 WMIC.exe Token: SeCreatePagefilePrivilege 2604 WMIC.exe Token: SeBackupPrivilege 2604 WMIC.exe Token: SeRestorePrivilege 2604 WMIC.exe Token: SeShutdownPrivilege 2604 WMIC.exe Token: SeDebugPrivilege 2604 WMIC.exe Token: SeSystemEnvironmentPrivilege 2604 WMIC.exe Token: SeRemoteShutdownPrivilege 2604 WMIC.exe Token: SeUndockPrivilege 2604 WMIC.exe Token: SeManageVolumePrivilege 2604 WMIC.exe Token: 33 2604 WMIC.exe Token: 34 2604 WMIC.exe Token: 35 2604 WMIC.exe Token: SeIncreaseQuotaPrivilege 2604 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2596 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 32 PID 2340 wrote to memory of 2596 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 32 PID 2340 wrote to memory of 2596 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 32 PID 2340 wrote to memory of 2596 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 32 PID 2596 wrote to memory of 2800 2596 cmd.exe 33 PID 2596 wrote to memory of 2800 2596 cmd.exe 33 PID 2596 wrote to memory of 2800 2596 cmd.exe 33 PID 2340 wrote to memory of 2576 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 34 PID 2340 wrote to memory of 2576 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 34 PID 2340 wrote to memory of 2576 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 34 PID 2340 wrote to memory of 2576 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 34 PID 2576 wrote to memory of 2604 2576 cmd.exe 36 PID 2576 wrote to memory of 2604 2576 cmd.exe 36 PID 2576 wrote to memory of 2604 2576 cmd.exe 36 PID 2340 wrote to memory of 2240 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 37 PID 2340 wrote to memory of 2240 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 37 PID 2340 wrote to memory of 2240 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 37 PID 2340 wrote to memory of 2240 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 37 PID 2240 wrote to memory of 3044 2240 cmd.exe 39 PID 2240 wrote to memory of 3044 2240 cmd.exe 39 PID 2240 wrote to memory of 3044 2240 cmd.exe 39 PID 2340 wrote to memory of 2892 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 40 PID 2340 wrote to memory of 2892 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 40 PID 2340 wrote to memory of 2892 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 40 PID 2340 wrote to memory of 2892 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 40 PID 2892 wrote to memory of 2872 2892 cmd.exe 42 PID 2892 wrote to memory of 2872 2892 cmd.exe 42 PID 2892 wrote to memory of 2872 2892 cmd.exe 42 PID 2340 wrote to memory of 2932 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 43 PID 2340 wrote to memory of 2932 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 43 PID 2340 wrote to memory of 2932 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 43 PID 2340 wrote to memory of 2932 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 43 PID 2932 wrote to memory of 2380 2932 cmd.exe 45 PID 2932 wrote to memory of 2380 2932 cmd.exe 45 PID 2932 wrote to memory of 2380 2932 cmd.exe 45 PID 2340 wrote to memory of 1092 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 46 PID 2340 wrote to memory of 1092 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 46 PID 2340 wrote to memory of 1092 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 46 PID 2340 wrote to memory of 1092 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 46 PID 1092 wrote to memory of 320 1092 cmd.exe 48 PID 1092 wrote to memory of 320 1092 cmd.exe 48 PID 1092 wrote to memory of 320 1092 cmd.exe 48 PID 2340 wrote to memory of 2396 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 49 PID 2340 wrote to memory of 2396 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 49 PID 2340 wrote to memory of 2396 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 49 PID 2340 wrote to memory of 2396 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 49 PID 2396 wrote to memory of 1104 2396 cmd.exe 51 PID 2396 wrote to memory of 1104 2396 cmd.exe 51 PID 2396 wrote to memory of 1104 2396 cmd.exe 51 PID 2340 wrote to memory of 844 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 52 PID 2340 wrote to memory of 844 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 52 PID 2340 wrote to memory of 844 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 52 PID 2340 wrote to memory of 844 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 52 PID 844 wrote to memory of 1652 844 cmd.exe 54 PID 844 wrote to memory of 1652 844 cmd.exe 54 PID 844 wrote to memory of 1652 844 cmd.exe 54 PID 2340 wrote to memory of 268 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 55 PID 2340 wrote to memory of 268 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 55 PID 2340 wrote to memory of 268 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 55 PID 2340 wrote to memory of 268 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 55 PID 268 wrote to memory of 684 268 cmd.exe 57 PID 268 wrote to memory of 684 268 cmd.exe 57 PID 268 wrote to memory of 684 268 cmd.exe 57 PID 2340 wrote to memory of 2672 2340 B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe 58 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe"C:\Users\Admin\AppData\Local\Temp\B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3A6169D6-66CE-4454-92CF-183F0483F60E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3A6169D6-66CE-4454-92CF-183F0483F60E}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5D2A3FAB-B006-415C-937B-61D5F87872A2}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5D2A3FAB-B006-415C-937B-61D5F87872A2}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF262CD8-FAB7-4534-9D54-159FC46FD90D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF262CD8-FAB7-4534-9D54-159FC46FD90D}'" delete3⤵PID:3044
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6057951-E7F0-44FE-B02D-4C17CE20D5BB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6057951-E7F0-44FE-B02D-4C17CE20D5BB}'" delete3⤵PID:2872
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DBB8983A-EC88-4DD3-A680-494BC6F9EC28}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DBB8983A-EC88-4DD3-A680-494BC6F9EC28}'" delete3⤵PID:2380
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{22CB1060-2399-483F-B431-10CB43E24F3C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{22CB1060-2399-483F-B431-10CB43E24F3C}'" delete3⤵PID:320
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CDCC00DA-4F0F-439E-AC88-A9B3C3DD6C98}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CDCC00DA-4F0F-439E-AC88-A9B3C3DD6C98}'" delete3⤵PID:1104
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E6699EA7-22A9-4DFD-AE33-D07B817E2419}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E6699EA7-22A9-4DFD-AE33-D07B817E2419}'" delete3⤵PID:1652
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{220BC6C4-6764-43A0-BEE6-BADA158BB00D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{220BC6C4-6764-43A0-BEE6-BADA158BB00D}'" delete3⤵PID:684
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA8831CD-61F9-475F-9B99-125E2F3FD392}'" delete2⤵PID:2672
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA8831CD-61F9-475F-9B99-125E2F3FD392}'" delete3⤵PID:2664
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B929D113-E242-4B83-BF6D-6B6A34B687E0}'" delete2⤵PID:2512
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B929D113-E242-4B83-BF6D-6B6A34B687E0}'" delete3⤵PID:1088
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DD3FBE7C-33E6-47F3-B092-E5D676D3118C}'" delete2⤵PID:1744
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DD3FBE7C-33E6-47F3-B092-E5D676D3118C}'" delete3⤵PID:2248
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CC09E084-D828-4E2F-BBE2-814ED35DD184}'" delete2⤵PID:1452
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CC09E084-D828-4E2F-BBE2-814ED35DD184}'" delete3⤵PID:2956
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E5B1C91-4C90-4ADD-AE31-C26CA8DDE524}'" delete2⤵PID:2920
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E5B1C91-4C90-4ADD-AE31-C26CA8DDE524}'" delete3⤵PID:2300
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C48B2F92-74BE-4673-8351-82FB344C970F}'" delete2⤵PID:2436
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C48B2F92-74BE-4673-8351-82FB344C970F}'" delete3⤵PID:1056
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{23C8B788-DA44-4DD0-8A61-F5B806CF7AD8}'" delete2⤵PID:436
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{23C8B788-DA44-4DD0-8A61-F5B806CF7AD8}'" delete3⤵PID:2348
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{60298CF0-CADC-4F42-AC53-5CE84A07A62A}'" delete2⤵PID:832
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{60298CF0-CADC-4F42-AC53-5CE84A07A62A}'" delete3⤵PID:2308
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0051B67B-015D-4400-BE25-5891239E87B1}'" delete2⤵PID:1336
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0051B67B-015D-4400-BE25-5891239E87B1}'" delete3⤵PID:932
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD598f3e62217ca5f8f11449407da8d074c
SHA1dd08305fac9b0d7207f20006726d920b1ae48ad7
SHA256d83cb12dc20ce9cd2018708fba2c370fd76fa6fc2c5ea948b94011ee3965af79
SHA51247d8bf1db1b3989707a8a3c9b0a0b4c9ca1b01af6bf7224e3abb8ed5618c9e91feafb9a92bd32e08e6efae154439399ea10b1874ba188d143963365a571c2bd3