Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-03-2024 04:41
Static task
static1
Behavioral task
behavioral1
Sample
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe
Resource
win10v2004-20240226-en
General
-
Target
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe
-
Size
192KB
-
MD5
0c4502d6655264a9aa420274a0ddeaeb
-
SHA1
b5510bd27327c7278843736aac085e16a508ed99
-
SHA256
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a
-
SHA512
21a8c7a83d5e0bb8b33182dee858e623887b308fb104f31a585227ab9507f910a6d5beffcd6d6a9dbe6180d2ac4262d4a82d308c73544d31dcd547a263a9b5e7
-
SSDEEP
3072:VWiyCqWkIcWoD0SrFykuOaXKcvQuoR0ainj9LaIRaRGbOwzidLEt1Jwm:iCqWkxg8toKcvQuk0dRTaACY1ym
Malware Config
Extracted
C:\Program Files (x86)\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.best
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
Processes:
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
Processes:
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\Documents\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\Videos\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Music\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\Music\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\Links\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe -
Drops file in Program Files directory 64 IoCs
Processes:
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exedescription ioc process File created C:\Program Files\Mozilla Firefox\uninstall\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\ui-strings.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\BRANDING.XML 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\plugin.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\cross.png 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sv-se\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\ui-strings.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\ui-strings.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-il\ui-strings.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ms_get.svg 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files\7-Zip\Lang\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\add-comment-2x.png 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ja-jp\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\pt-br\ui-strings.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.ELM 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\dotnet\LICENSE.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOnNotificationInTray.gif 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\en-US\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\MoreTools.aapp 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\tt.pak.DATA 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.NETCore.App.deps.json 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Trust Protection Lists\Sigma\Other.DATA 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files\Common Files\System\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\kn.pak.DATA 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\js\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Locales\sr-Cyrl-BA.pak 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\readme.txt 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\ui-strings.js 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\circle.cur 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exepid process 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
vssvc.exeWMIC.exedescription pid process Token: SeBackupPrivilege 4888 vssvc.exe Token: SeRestorePrivilege 4888 vssvc.exe Token: SeAuditPrivilege 4888 vssvc.exe Token: SeIncreaseQuotaPrivilege 3784 WMIC.exe Token: SeSecurityPrivilege 3784 WMIC.exe Token: SeTakeOwnershipPrivilege 3784 WMIC.exe Token: SeLoadDriverPrivilege 3784 WMIC.exe Token: SeSystemProfilePrivilege 3784 WMIC.exe Token: SeSystemtimePrivilege 3784 WMIC.exe Token: SeProfSingleProcessPrivilege 3784 WMIC.exe Token: SeIncBasePriorityPrivilege 3784 WMIC.exe Token: SeCreatePagefilePrivilege 3784 WMIC.exe Token: SeBackupPrivilege 3784 WMIC.exe Token: SeRestorePrivilege 3784 WMIC.exe Token: SeShutdownPrivilege 3784 WMIC.exe Token: SeDebugPrivilege 3784 WMIC.exe Token: SeSystemEnvironmentPrivilege 3784 WMIC.exe Token: SeRemoteShutdownPrivilege 3784 WMIC.exe Token: SeUndockPrivilege 3784 WMIC.exe Token: SeManageVolumePrivilege 3784 WMIC.exe Token: 33 3784 WMIC.exe Token: 34 3784 WMIC.exe Token: 35 3784 WMIC.exe Token: 36 3784 WMIC.exe Token: SeIncreaseQuotaPrivilege 3784 WMIC.exe Token: SeSecurityPrivilege 3784 WMIC.exe Token: SeTakeOwnershipPrivilege 3784 WMIC.exe Token: SeLoadDriverPrivilege 3784 WMIC.exe Token: SeSystemProfilePrivilege 3784 WMIC.exe Token: SeSystemtimePrivilege 3784 WMIC.exe Token: SeProfSingleProcessPrivilege 3784 WMIC.exe Token: SeIncBasePriorityPrivilege 3784 WMIC.exe Token: SeCreatePagefilePrivilege 3784 WMIC.exe Token: SeBackupPrivilege 3784 WMIC.exe Token: SeRestorePrivilege 3784 WMIC.exe Token: SeShutdownPrivilege 3784 WMIC.exe Token: SeDebugPrivilege 3784 WMIC.exe Token: SeSystemEnvironmentPrivilege 3784 WMIC.exe Token: SeRemoteShutdownPrivilege 3784 WMIC.exe Token: SeUndockPrivilege 3784 WMIC.exe Token: SeManageVolumePrivilege 3784 WMIC.exe Token: 33 3784 WMIC.exe Token: 34 3784 WMIC.exe Token: 35 3784 WMIC.exe Token: 36 3784 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.execmd.exedescription pid process target process PID 996 wrote to memory of 5104 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe cmd.exe PID 996 wrote to memory of 5104 996 14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe cmd.exe PID 5104 wrote to memory of 3784 5104 cmd.exe WMIC.exe PID 5104 wrote to memory of 3784 5104 cmd.exe WMIC.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe"C:\Users\Admin\AppData\Local\Temp\14f9538dd611ca701bdbc6b34a0562e8b18c2492ff323b32557b36673434541a.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4E876414-77A6-471B-B6FE-F003B840FFC1}'" delete2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4E876414-77A6-471B-B6FE-F003B840FFC1}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\readme.txtFilesize
1KB
MD5ceaa77d1461263a97b5ebdd0c8c23a77
SHA1601a3b437803e903a178516218146806cc93db12
SHA256a35ab41d505749753d8f5a5043f1b6234d1a20dad75e4c9863a3535d53d8b420
SHA5128fd2c205883bb195498ea391632c064ffc7929c6c4fe50e5c3873eabcda2cb43e7a0a48462bb0f9011775b79e1057407fb2003962f8479fd574e42e46316d08b