Resubmissions
26-02-2024 15:26
240226-svaewshd58 1026-02-2024 03:44
240226-eay1vsce3t 1026-05-2021 23:16
210526-l2kg6w9n4a 10Analysis
-
max time kernel
15s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe
-
Size
196KB
-
MD5
58b16b1ea734d18960927cd68040c72d
-
SHA1
ab31613ceb08db6aea6b90370e259be1e9243070
-
SHA256
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7
-
SHA512
7b2b180005974afef8be76431c06eb22910d67863d80f738999030aa0a9707421ecb847a864b9a1c2a4fd03909fd35377d44276e69586a33c2fcb8ce4c8371f1
-
SSDEEP
3072:CLJGBP1t82ETTwPAobQ3tOqmb14Gul22QZkN7S44EXZ50Rx6:gJEPCTwPp03YqyNulakHu6
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI strain.
As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.
To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.top/
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.
---BEGIN ID---
3oGjGn43irQZrKl1Tykk77x4alv7UkOkD9ru3aywuSN0ufrLAF1rZS40oEtMRe2j
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 3 IoCs
Processes:
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exedescription ioc Process File opened for modification C:\Program Files\desktop.ini 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files (x86)\desktop.ini 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Users\Public\desktop.ini 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe -
Drops file in Program Files directory 64 IoCs
Processes:
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exedescription ioc Process File opened for modification C:\Program Files\PingMount.xps 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\defaultagent.ini 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ie9props.propdesc 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\StepRemove.vsdx 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\postSigningData 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files (x86)\Google\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files\Internet Explorer\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\CompareSuspend.html 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\RenameLock.xps 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\descript.ion 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files (x86)\Microsoft Office\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files (x86)\Uninstall Information\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\UnregisterGrant.doc 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\InitializeApprove.mpp 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\defaultagent_localized.ini 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\LimitComplete.ogg 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\NewApprove.vdw 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\UseSuspend.shtml 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\ExportSet.fon 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\HideRequest.ppt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\History.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\removed-files 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\RenameUndo.M2TS 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\DVD Maker\offset.ax 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files (x86)\Reference Assemblies\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\MountSearch.docx 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files\Microsoft Office\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files\MSBuild\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files\Reference Assemblies\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\desktop.ini 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\InvokeRequest.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\SendStep.html 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\License.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File created C:\Program Files\DVD Maker\readme.txt 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\AddRestart.ADT 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\JoinGrant.vst 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exepid Process 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid Process Token: SeBackupPrivilege 2772 vssvc.exe Token: SeRestorePrivilege 2772 vssvc.exe Token: SeAuditPrivilege 2772 vssvc.exe Token: SeIncreaseQuotaPrivilege 2512 WMIC.exe Token: SeSecurityPrivilege 2512 WMIC.exe Token: SeTakeOwnershipPrivilege 2512 WMIC.exe Token: SeLoadDriverPrivilege 2512 WMIC.exe Token: SeSystemProfilePrivilege 2512 WMIC.exe Token: SeSystemtimePrivilege 2512 WMIC.exe Token: SeProfSingleProcessPrivilege 2512 WMIC.exe Token: SeIncBasePriorityPrivilege 2512 WMIC.exe Token: SeCreatePagefilePrivilege 2512 WMIC.exe Token: SeBackupPrivilege 2512 WMIC.exe Token: SeRestorePrivilege 2512 WMIC.exe Token: SeShutdownPrivilege 2512 WMIC.exe Token: SeDebugPrivilege 2512 WMIC.exe Token: SeSystemEnvironmentPrivilege 2512 WMIC.exe Token: SeRemoteShutdownPrivilege 2512 WMIC.exe Token: SeUndockPrivilege 2512 WMIC.exe Token: SeManageVolumePrivilege 2512 WMIC.exe Token: 33 2512 WMIC.exe Token: 34 2512 WMIC.exe Token: 35 2512 WMIC.exe Token: SeIncreaseQuotaPrivilege 2512 WMIC.exe Token: SeSecurityPrivilege 2512 WMIC.exe Token: SeTakeOwnershipPrivilege 2512 WMIC.exe Token: SeLoadDriverPrivilege 2512 WMIC.exe Token: SeSystemProfilePrivilege 2512 WMIC.exe Token: SeSystemtimePrivilege 2512 WMIC.exe Token: SeProfSingleProcessPrivilege 2512 WMIC.exe Token: SeIncBasePriorityPrivilege 2512 WMIC.exe Token: SeCreatePagefilePrivilege 2512 WMIC.exe Token: SeBackupPrivilege 2512 WMIC.exe Token: SeRestorePrivilege 2512 WMIC.exe Token: SeShutdownPrivilege 2512 WMIC.exe Token: SeDebugPrivilege 2512 WMIC.exe Token: SeSystemEnvironmentPrivilege 2512 WMIC.exe Token: SeRemoteShutdownPrivilege 2512 WMIC.exe Token: SeUndockPrivilege 2512 WMIC.exe Token: SeManageVolumePrivilege 2512 WMIC.exe Token: 33 2512 WMIC.exe Token: 34 2512 WMIC.exe Token: 35 2512 WMIC.exe Token: SeIncreaseQuotaPrivilege 2532 WMIC.exe Token: SeSecurityPrivilege 2532 WMIC.exe Token: SeTakeOwnershipPrivilege 2532 WMIC.exe Token: SeLoadDriverPrivilege 2532 WMIC.exe Token: SeSystemProfilePrivilege 2532 WMIC.exe Token: SeSystemtimePrivilege 2532 WMIC.exe Token: SeProfSingleProcessPrivilege 2532 WMIC.exe Token: SeIncBasePriorityPrivilege 2532 WMIC.exe Token: SeCreatePagefilePrivilege 2532 WMIC.exe Token: SeBackupPrivilege 2532 WMIC.exe Token: SeRestorePrivilege 2532 WMIC.exe Token: SeShutdownPrivilege 2532 WMIC.exe Token: SeDebugPrivilege 2532 WMIC.exe Token: SeSystemEnvironmentPrivilege 2532 WMIC.exe Token: SeRemoteShutdownPrivilege 2532 WMIC.exe Token: SeUndockPrivilege 2532 WMIC.exe Token: SeManageVolumePrivilege 2532 WMIC.exe Token: 33 2532 WMIC.exe Token: 34 2532 WMIC.exe Token: 35 2532 WMIC.exe Token: SeIncreaseQuotaPrivilege 2532 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 1532 wrote to memory of 2528 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 24 PID 1532 wrote to memory of 2528 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 24 PID 1532 wrote to memory of 2528 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 24 PID 1532 wrote to memory of 2528 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 24 PID 2528 wrote to memory of 2512 2528 cmd.exe 22 PID 2528 wrote to memory of 2512 2528 cmd.exe 22 PID 2528 wrote to memory of 2512 2528 cmd.exe 22 PID 1532 wrote to memory of 2712 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 21 PID 1532 wrote to memory of 2712 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 21 PID 1532 wrote to memory of 2712 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 21 PID 1532 wrote to memory of 2712 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 21 PID 2712 wrote to memory of 2532 2712 cmd.exe 19 PID 2712 wrote to memory of 2532 2712 cmd.exe 19 PID 2712 wrote to memory of 2532 2712 cmd.exe 19 PID 1532 wrote to memory of 2400 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 18 PID 1532 wrote to memory of 2400 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 18 PID 1532 wrote to memory of 2400 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 18 PID 1532 wrote to memory of 2400 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 18 PID 2400 wrote to memory of 2428 2400 cmd.exe 16 PID 2400 wrote to memory of 2428 2400 cmd.exe 16 PID 2400 wrote to memory of 2428 2400 cmd.exe 16 PID 1532 wrote to memory of 2876 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 15 PID 1532 wrote to memory of 2876 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 15 PID 1532 wrote to memory of 2876 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 15 PID 1532 wrote to memory of 2876 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 15 PID 2876 wrote to memory of 3012 2876 cmd.exe 13 PID 2876 wrote to memory of 3012 2876 cmd.exe 13 PID 2876 wrote to memory of 3012 2876 cmd.exe 13 PID 1532 wrote to memory of 392 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 12 PID 1532 wrote to memory of 392 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 12 PID 1532 wrote to memory of 392 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 12 PID 1532 wrote to memory of 392 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 12 PID 392 wrote to memory of 1116 392 cmd.exe 10 PID 392 wrote to memory of 1116 392 cmd.exe 10 PID 392 wrote to memory of 1116 392 cmd.exe 10 PID 1532 wrote to memory of 1888 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 9 PID 1532 wrote to memory of 1888 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 9 PID 1532 wrote to memory of 1888 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 9 PID 1532 wrote to memory of 1888 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 9 PID 1888 wrote to memory of 2224 1888 cmd.exe 7 PID 1888 wrote to memory of 2224 1888 cmd.exe 7 PID 1888 wrote to memory of 2224 1888 cmd.exe 7 PID 1532 wrote to memory of 948 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 6 PID 1532 wrote to memory of 948 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 6 PID 1532 wrote to memory of 948 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 6 PID 1532 wrote to memory of 948 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 6 PID 948 wrote to memory of 1068 948 cmd.exe 4 PID 948 wrote to memory of 1068 948 cmd.exe 4 PID 948 wrote to memory of 1068 948 cmd.exe 4 PID 1532 wrote to memory of 2696 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 3 PID 1532 wrote to memory of 2696 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 3 PID 1532 wrote to memory of 2696 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 3 PID 1532 wrote to memory of 2696 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 3 PID 2696 wrote to memory of 2572 2696 cmd.exe 1 PID 2696 wrote to memory of 2572 2696 cmd.exe 1 PID 2696 wrote to memory of 2572 2696 cmd.exe 1 PID 1532 wrote to memory of 1072 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 56 PID 1532 wrote to memory of 1072 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 56 PID 1532 wrote to memory of 1072 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 56 PID 1532 wrote to memory of 1072 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 56 PID 1072 wrote to memory of 1896 1072 cmd.exe 57 PID 1072 wrote to memory of 1896 1072 cmd.exe 57 PID 1072 wrote to memory of 1896 1072 cmd.exe 57 PID 1532 wrote to memory of 1756 1532 58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe 58 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68712A02-8F02-4CD5-BDC3-49A46F7FCFAF}'" delete1⤵PID:2572
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68712A02-8F02-4CD5-BDC3-49A46F7FCFAF}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:2696
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F5EC4895-427C-4C2A-91E7-880BF2BDE1CC}'" delete1⤵PID:1068
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F5EC4895-427C-4C2A-91E7-880BF2BDE1CC}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:948
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF0E04A7-8711-402B-8C20-EEB832489320}'" delete1⤵PID:2224
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF0E04A7-8711-402B-8C20-EEB832489320}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:1888
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF040487-4543-4ED1-ADEF-D3FDA4645F47}'" delete1⤵PID:1116
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF040487-4543-4ED1-ADEF-D3FDA4645F47}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:392
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{93CC03E3-6DF1-4637-BD22-4710443E5940}'" delete1⤵PID:3012
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{93CC03E3-6DF1-4637-BD22-4710443E5940}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:2876
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{55EEE98E-8407-462D-BD0F-BB7B75CE31BD}'" delete1⤵PID:2428
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{55EEE98E-8407-462D-BD0F-BB7B75CE31BD}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:2400
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3CA3636-424E-4EE7-AA3B-DD9FE71DB7EF}'" delete1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3CA3636-424E-4EE7-AA3B-DD9FE71DB7EF}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:2712
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E81ECA34-0487-4F22-84AF-24B24EFC10F5}'" delete1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E81ECA34-0487-4F22-84AF-24B24EFC10F5}'" delete1⤵
- Suspicious use of WriteProcessMemory
PID:2528
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
C:\Users\Admin\AppData\Local\Temp\58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe"C:\Users\Admin\AppData\Local\Temp\58ca4e482db7cf5c924256e53d8516d422e76cf4b85b43dc2b9ba0c7cb471ff7.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D214B12C-18E5-4F9B-8285-2E67C974D5C6}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D214B12C-18E5-4F9B-8285-2E67C974D5C6}'" delete3⤵PID:1896
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E3B6FDDF-F69E-42D8-9784-6491C8FAF565}'" delete2⤵PID:1756
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E3B6FDDF-F69E-42D8-9784-6491C8FAF565}'" delete3⤵PID:2716
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1D9F7447-5EF0-4664-B284-7F089E1F3046}'" delete2⤵PID:2000
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1D9F7447-5EF0-4664-B284-7F089E1F3046}'" delete3⤵PID:1200
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19173608-B2D7-4496-AF78-575677249E0D}'" delete2⤵PID:2204
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{19173608-B2D7-4496-AF78-575677249E0D}'" delete3⤵PID:2200
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AA53263B-500C-44CA-9451-E02FC42C641C}'" delete2⤵PID:1540
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AA53263B-500C-44CA-9451-E02FC42C641C}'" delete3⤵PID:2272
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{442F1A31-BF66-4847-8677-49387E6CF18D}'" delete2⤵PID:3044
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{442F1A31-BF66-4847-8677-49387E6CF18D}'" delete3⤵PID:2280
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C9AD2CD3-B216-4DA9-8395-7248C5BCB39F}'" delete2⤵PID:672
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C9AD2CD3-B216-4DA9-8395-7248C5BCB39F}'" delete3⤵PID:792
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ED2ABB9C-6F00-40D8-B24C-9C055703EE86}'" delete2⤵PID:1900
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ED2ABB9C-6F00-40D8-B24C-9C055703EE86}'" delete3⤵PID:2268
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B59BF6AD-AD3F-48D7-8AC5-C00E28BB661F}'" delete2⤵PID:2988
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B59BF6AD-AD3F-48D7-8AC5-C00E28BB661F}'" delete3⤵PID:2984
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D7FFFCBE-24E2-4A8B-A802-375E6EC5AB99}'" delete2⤵PID:1052
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D7FFFCBE-24E2-4A8B-A802-375E6EC5AB99}'" delete3⤵PID:1812
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b87b63355379f17bb06a2570c8d88b04
SHA184d6a08e78da221fea6ec46fe7b7ac87412e23c2
SHA256284959ed3f68fb912cb141ef31b4ad4b53147bd1082ec1ed83bd08af729d09d1
SHA512bad79ae1efc718a90e089b9cdea8bfb149adbcddfc79cef529ab11055ce723a23608402b78e2655e5d5f9c72e26726390a1dbb24a2abfaca6e964e26e36c275e