Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 10:22
Static task
static1
Behavioral task
behavioral1
Sample
38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe
Resource
win10v2004-20240226-en
General
-
Target
38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe
-
Size
1.0MB
-
MD5
8c54c65f1f36c13a3b67301ada6f9744
-
SHA1
a803a4b305415b66f22ed29d08017c286b8cb9ef
-
SHA256
38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a
-
SHA512
ddce93ccd5af59fb4b9a3687664e19b2a6e69a09eff6e4504ff8de7d6420609f10f27ca4bd41b04dd9bdbe1bf76ee97f1b2c4a8ec766424a49312c753da3f748
-
SSDEEP
24576:IBktd5tCfUsfLKX02b74GbOXHbqK3sCST/W:I6tFC8oKOmssCST/W
Malware Config
Extracted
C:\Program Files (x86)\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/rw0J6Ap3LZNfxsJyo6UpClQbrgD1dzRjxZLVZep0QQEFdl01ihbHIkEvZt91EvtA
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7972) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
description ioc Process File opened for modification C:\Users\Admin\Searches\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JSZQNXMR\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Links\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Music\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Documents\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\6QIBR00Y\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\87XXOISN\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Videos\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\HKGE1S7K\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Admin\Music\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00175_.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00391_.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PREVIEW.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.INF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_K_COL.HXK 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\THMBNAIL.PNG 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115867.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7en.kic 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217872.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386764.JPG 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKDECS.ICO 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Swift_Current 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Atikokan 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Earthy.css 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152608.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00788_.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\SONORA.ELM 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN105.XML 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files (x86)\Common Files\Adobe\Help\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_F_COL.HXK 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL077.XML 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\HEADER.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\PREVIEW.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_zh_4.4.0.v20140623020002.jar 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL107.XML 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24ImagesMask.bmp 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107024.WMF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02077_.GIF 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN011.XML 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\readme.txt 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2572 vssvc.exe Token: SeRestorePrivilege 2572 vssvc.exe Token: SeAuditPrivilege 2572 vssvc.exe Token: SeIncreaseQuotaPrivilege 2400 WMIC.exe Token: SeSecurityPrivilege 2400 WMIC.exe Token: SeTakeOwnershipPrivilege 2400 WMIC.exe Token: SeLoadDriverPrivilege 2400 WMIC.exe Token: SeSystemProfilePrivilege 2400 WMIC.exe Token: SeSystemtimePrivilege 2400 WMIC.exe Token: SeProfSingleProcessPrivilege 2400 WMIC.exe Token: SeIncBasePriorityPrivilege 2400 WMIC.exe Token: SeCreatePagefilePrivilege 2400 WMIC.exe Token: SeBackupPrivilege 2400 WMIC.exe Token: SeRestorePrivilege 2400 WMIC.exe Token: SeShutdownPrivilege 2400 WMIC.exe Token: SeDebugPrivilege 2400 WMIC.exe Token: SeSystemEnvironmentPrivilege 2400 WMIC.exe Token: SeRemoteShutdownPrivilege 2400 WMIC.exe Token: SeUndockPrivilege 2400 WMIC.exe Token: SeManageVolumePrivilege 2400 WMIC.exe Token: 33 2400 WMIC.exe Token: 34 2400 WMIC.exe Token: 35 2400 WMIC.exe Token: SeIncreaseQuotaPrivilege 2400 WMIC.exe Token: SeSecurityPrivilege 2400 WMIC.exe Token: SeTakeOwnershipPrivilege 2400 WMIC.exe Token: SeLoadDriverPrivilege 2400 WMIC.exe Token: SeSystemProfilePrivilege 2400 WMIC.exe Token: SeSystemtimePrivilege 2400 WMIC.exe Token: SeProfSingleProcessPrivilege 2400 WMIC.exe Token: SeIncBasePriorityPrivilege 2400 WMIC.exe Token: SeCreatePagefilePrivilege 2400 WMIC.exe Token: SeBackupPrivilege 2400 WMIC.exe Token: SeRestorePrivilege 2400 WMIC.exe Token: SeShutdownPrivilege 2400 WMIC.exe Token: SeDebugPrivilege 2400 WMIC.exe Token: SeSystemEnvironmentPrivilege 2400 WMIC.exe Token: SeRemoteShutdownPrivilege 2400 WMIC.exe Token: SeUndockPrivilege 2400 WMIC.exe Token: SeManageVolumePrivilege 2400 WMIC.exe Token: 33 2400 WMIC.exe Token: 34 2400 WMIC.exe Token: 35 2400 WMIC.exe Token: SeIncreaseQuotaPrivilege 3004 WMIC.exe Token: SeSecurityPrivilege 3004 WMIC.exe Token: SeTakeOwnershipPrivilege 3004 WMIC.exe Token: SeLoadDriverPrivilege 3004 WMIC.exe Token: SeSystemProfilePrivilege 3004 WMIC.exe Token: SeSystemtimePrivilege 3004 WMIC.exe Token: SeProfSingleProcessPrivilege 3004 WMIC.exe Token: SeIncBasePriorityPrivilege 3004 WMIC.exe Token: SeCreatePagefilePrivilege 3004 WMIC.exe Token: SeBackupPrivilege 3004 WMIC.exe Token: SeRestorePrivilege 3004 WMIC.exe Token: SeShutdownPrivilege 3004 WMIC.exe Token: SeDebugPrivilege 3004 WMIC.exe Token: SeSystemEnvironmentPrivilege 3004 WMIC.exe Token: SeRemoteShutdownPrivilege 3004 WMIC.exe Token: SeUndockPrivilege 3004 WMIC.exe Token: SeManageVolumePrivilege 3004 WMIC.exe Token: 33 3004 WMIC.exe Token: 34 3004 WMIC.exe Token: 35 3004 WMIC.exe Token: SeIncreaseQuotaPrivilege 3004 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2348 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 31 PID 1984 wrote to memory of 2348 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 31 PID 1984 wrote to memory of 2348 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 31 PID 1984 wrote to memory of 2348 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 31 PID 2348 wrote to memory of 2400 2348 cmd.exe 33 PID 2348 wrote to memory of 2400 2348 cmd.exe 33 PID 2348 wrote to memory of 2400 2348 cmd.exe 33 PID 1984 wrote to memory of 2816 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 34 PID 1984 wrote to memory of 2816 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 34 PID 1984 wrote to memory of 2816 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 34 PID 1984 wrote to memory of 2816 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 34 PID 2816 wrote to memory of 3004 2816 cmd.exe 36 PID 2816 wrote to memory of 3004 2816 cmd.exe 36 PID 2816 wrote to memory of 3004 2816 cmd.exe 36 PID 1984 wrote to memory of 768 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 37 PID 1984 wrote to memory of 768 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 37 PID 1984 wrote to memory of 768 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 37 PID 1984 wrote to memory of 768 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 37 PID 768 wrote to memory of 1216 768 cmd.exe 39 PID 768 wrote to memory of 1216 768 cmd.exe 39 PID 768 wrote to memory of 1216 768 cmd.exe 39 PID 1984 wrote to memory of 2424 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 40 PID 1984 wrote to memory of 2424 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 40 PID 1984 wrote to memory of 2424 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 40 PID 1984 wrote to memory of 2424 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 40 PID 2424 wrote to memory of 2672 2424 cmd.exe 42 PID 2424 wrote to memory of 2672 2424 cmd.exe 42 PID 2424 wrote to memory of 2672 2424 cmd.exe 42 PID 1984 wrote to memory of 2700 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 43 PID 1984 wrote to memory of 2700 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 43 PID 1984 wrote to memory of 2700 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 43 PID 1984 wrote to memory of 2700 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 43 PID 2700 wrote to memory of 2124 2700 cmd.exe 45 PID 2700 wrote to memory of 2124 2700 cmd.exe 45 PID 2700 wrote to memory of 2124 2700 cmd.exe 45 PID 1984 wrote to memory of 804 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 46 PID 1984 wrote to memory of 804 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 46 PID 1984 wrote to memory of 804 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 46 PID 1984 wrote to memory of 804 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 46 PID 804 wrote to memory of 1004 804 cmd.exe 48 PID 804 wrote to memory of 1004 804 cmd.exe 48 PID 804 wrote to memory of 1004 804 cmd.exe 48 PID 1984 wrote to memory of 2108 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 49 PID 1984 wrote to memory of 2108 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 49 PID 1984 wrote to memory of 2108 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 49 PID 1984 wrote to memory of 2108 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 49 PID 2108 wrote to memory of 1556 2108 cmd.exe 51 PID 2108 wrote to memory of 1556 2108 cmd.exe 51 PID 2108 wrote to memory of 1556 2108 cmd.exe 51 PID 1984 wrote to memory of 864 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 52 PID 1984 wrote to memory of 864 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 52 PID 1984 wrote to memory of 864 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 52 PID 1984 wrote to memory of 864 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 52 PID 864 wrote to memory of 2244 864 cmd.exe 54 PID 864 wrote to memory of 2244 864 cmd.exe 54 PID 864 wrote to memory of 2244 864 cmd.exe 54 PID 1984 wrote to memory of 2016 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 55 PID 1984 wrote to memory of 2016 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 55 PID 1984 wrote to memory of 2016 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 55 PID 1984 wrote to memory of 2016 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 55 PID 2016 wrote to memory of 2032 2016 cmd.exe 57 PID 2016 wrote to memory of 2032 2016 cmd.exe 57 PID 2016 wrote to memory of 2032 2016 cmd.exe 57 PID 1984 wrote to memory of 3040 1984 38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe 58 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe"C:\Users\Admin\AppData\Local\Temp\38784c635de9716c09a6f11f4d76f6402b5f6638f1614ed929c7de136bb5301a.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C15C256B-6379-4665-A338-E2D9E4C8AEA6}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C15C256B-6379-4665-A338-E2D9E4C8AEA6}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5D13C87E-1868-4E39-9103-C26EA61A00BC}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{5D13C87E-1868-4E39-9103-C26EA61A00BC}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{388E9C45-2E55-4938-8617-E2FD9997E199}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{388E9C45-2E55-4938-8617-E2FD9997E199}'" delete3⤵PID:1216
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EEDBC91D-350A-445F-A5FA-8CFB634AA8B1}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EEDBC91D-350A-445F-A5FA-8CFB634AA8B1}'" delete3⤵PID:2672
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EFE98FFB-4EB3-4ED4-BAD6-C4FEB682AC20}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EFE98FFB-4EB3-4ED4-BAD6-C4FEB682AC20}'" delete3⤵PID:2124
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DAFA4823-3D11-4CA1-AB96-64EFD6C0E00F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DAFA4823-3D11-4CA1-AB96-64EFD6C0E00F}'" delete3⤵PID:1004
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E779013E-8DB4-41F2-8EC8-A4987880D2DB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E779013E-8DB4-41F2-8EC8-A4987880D2DB}'" delete3⤵PID:1556
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{53318545-7FFF-47CF-BCA1-9FA9A3C81BAD}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{53318545-7FFF-47CF-BCA1-9FA9A3C81BAD}'" delete3⤵PID:2244
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E98F4359-BA3C-4D46-8FDE-CF4E4F23EBC6}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E98F4359-BA3C-4D46-8FDE-CF4E4F23EBC6}'" delete3⤵PID:2032
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FDCECBEE-F39E-4CF4-8BC4-817DB724B0BA}'" delete2⤵PID:3040
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FDCECBEE-F39E-4CF4-8BC4-817DB724B0BA}'" delete3⤵PID:2300
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{268BC89B-6DCE-4D92-9633-E60E4D4AAB39}'" delete2⤵PID:1880
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{268BC89B-6DCE-4D92-9633-E60E4D4AAB39}'" delete3⤵PID:1980
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{373ED35F-2590-4A5B-ACF1-D7091F38C86D}'" delete2⤵PID:2756
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{373ED35F-2590-4A5B-ACF1-D7091F38C86D}'" delete3⤵PID:1912
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E1C1CFD6-10AF-4205-A8FA-66B061DB3535}'" delete2⤵PID:684
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E1C1CFD6-10AF-4205-A8FA-66B061DB3535}'" delete3⤵PID:1420
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B657DD0F-4AF2-40D9-9A6D-0DF2F826AED0}'" delete2⤵PID:1056
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B657DD0F-4AF2-40D9-9A6D-0DF2F826AED0}'" delete3⤵PID:1776
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56AA3474-1F18-4675-938E-301B8D794F72}'" delete2⤵PID:792
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56AA3474-1F18-4675-938E-301B8D794F72}'" delete3⤵PID:1600
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3D2B03DD-F6FC-4940-BD7F-41A38700E570}'" delete2⤵PID:3056
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3D2B03DD-F6FC-4940-BD7F-41A38700E570}'" delete3⤵PID:452
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C6AFF417-4752-4791-B554-09E90991990E}'" delete2⤵PID:2880
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C6AFF417-4752-4791-B554-09E90991990E}'" delete3⤵PID:996
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{437DEFDF-CA92-4104-A29A-573A1F0DE09E}'" delete2⤵PID:1248
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{437DEFDF-CA92-4104-A29A-573A1F0DE09E}'" delete3⤵PID:1684
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5948e44c34cf7cc57dfa17bc7e076c9f3
SHA1ece17df8a21eb08f8d7ebafaf8e7dc9c850343fc
SHA25681125cd4cf350d1578de9d0d3713389c831224568c30325c1c50e1afc2a79816
SHA512c74e7177de1dcbd6c3bebaad299e96a87e92ae55753bdf0d39e48891818323c05f56cc5349ae5c105eb1288e6e807421f1406a8df837517d55e8476a79efb13a