conti | 41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5

Analysis

max time kernel
162s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
Size

329KB
MD5

f365f7f6c852c1ac172a331d75e8cad5
SHA1

683100cbbdf110828e0ee5e4acf20fc17f596c7a
SHA256

41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5
SHA512

054f22c4fbb377a08bc1c64d441d6b09d3f6451b6b1b2073e77da54fd05075a61dd650525e395d74491856602188ebaf0c19e157ad2153494bcdb2e2e35fc4b8
SSDEEP

6144:8y4IzfDPuh+i2G1EVxJelMWEWEWfiN+DDo0fRjy1KGTKc4dPdEkBC92hOZg+7H:Lf6h+i2hxcKNtpGDFfxy1rK7dW2Cf7H

Score

10^/10

conti ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- nxGtsvw2bTXAT1KrASQNsiIDqMUk1njit8CpshTA40lnS7JPQpZTLdDQ1YYlM3YX ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Renames multiple (3269) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLASSIC1.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107300.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ASCIIENG.LNG	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00402_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285444.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00233_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.XLS	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02417U.BMP	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01253_.GIF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTEAR.DPV	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00241_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153089.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01356_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02794_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Paper.thmx	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0252349.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301252.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File created	C:\Program Files (x86)\Common Files\System\ja-JP\readme.txt	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297749.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DESKSAM.SAM	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Adjacency.thmx	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107450.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241781.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_COL.HXT	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.HLP	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HTECH_01.MID	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXT	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00096_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00623_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297725.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341448.JPG	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\Issue Tracking.gta	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADVTEL.DIC	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00018_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.HXS	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232171.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382836.JPG	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETLG.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00330_.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BS2BARB.POC	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL058.XML	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OL.SAM	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File created	C:\Program Files (x86)\readme.txt	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File created	C:\Program Files\Microsoft Games\Purble Place\readme.txt	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Newsprint.thmx	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.ICO	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199423.WMF	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2440	vssvc.exe
Token: SeRestorePrivilege	2440	vssvc.exe
Token: SeAuditPrivilege	2440	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2484	WMIC.exe
Token: SeSecurityPrivilege	2484	WMIC.exe
Token: SeTakeOwnershipPrivilege	2484	WMIC.exe
Token: SeLoadDriverPrivilege	2484	WMIC.exe
Token: SeSystemProfilePrivilege	2484	WMIC.exe
Token: SeSystemtimePrivilege	2484	WMIC.exe
Token: SeProfSingleProcessPrivilege	2484	WMIC.exe
Token: SeIncBasePriorityPrivilege	2484	WMIC.exe
Token: SeCreatePagefilePrivilege	2484	WMIC.exe
Token: SeBackupPrivilege	2484	WMIC.exe
Token: SeRestorePrivilege	2484	WMIC.exe
Token: SeShutdownPrivilege	2484	WMIC.exe
Token: SeDebugPrivilege	2484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2484	WMIC.exe
Token: SeRemoteShutdownPrivilege	2484	WMIC.exe
Token: SeUndockPrivilege	2484	WMIC.exe
Token: SeManageVolumePrivilege	2484	WMIC.exe
Token: 33	2484	WMIC.exe
Token: 34	2484	WMIC.exe
Token: 35	2484	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2484	WMIC.exe
Token: SeSecurityPrivilege	2484	WMIC.exe
Token: SeTakeOwnershipPrivilege	2484	WMIC.exe
Token: SeLoadDriverPrivilege	2484	WMIC.exe
Token: SeSystemProfilePrivilege	2484	WMIC.exe
Token: SeSystemtimePrivilege	2484	WMIC.exe
Token: SeProfSingleProcessPrivilege	2484	WMIC.exe
Token: SeIncBasePriorityPrivilege	2484	WMIC.exe
Token: SeCreatePagefilePrivilege	2484	WMIC.exe
Token: SeBackupPrivilege	2484	WMIC.exe
Token: SeRestorePrivilege	2484	WMIC.exe
Token: SeShutdownPrivilege	2484	WMIC.exe
Token: SeDebugPrivilege	2484	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2484	WMIC.exe
Token: SeRemoteShutdownPrivilege	2484	WMIC.exe
Token: SeUndockPrivilege	2484	WMIC.exe
Token: SeManageVolumePrivilege	2484	WMIC.exe
Token: 33	2484	WMIC.exe
Token: 34	2484	WMIC.exe
Token: 35	2484	WMIC.exe
Token: SeIncreaseQuotaPrivilege	604	WMIC.exe
Token: SeSecurityPrivilege	604	WMIC.exe
Token: SeTakeOwnershipPrivilege	604	WMIC.exe
Token: SeLoadDriverPrivilege	604	WMIC.exe
Token: SeSystemProfilePrivilege	604	WMIC.exe
Token: SeSystemtimePrivilege	604	WMIC.exe
Token: SeProfSingleProcessPrivilege	604	WMIC.exe
Token: SeIncBasePriorityPrivilege	604	WMIC.exe
Token: SeCreatePagefilePrivilege	604	WMIC.exe
Token: SeBackupPrivilege	604	WMIC.exe
Token: SeRestorePrivilege	604	WMIC.exe
Token: SeShutdownPrivilege	604	WMIC.exe
Token: SeDebugPrivilege	604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	604	WMIC.exe
Token: SeRemoteShutdownPrivilege	604	WMIC.exe
Token: SeUndockPrivilege	604	WMIC.exe
Token: SeManageVolumePrivilege	604	WMIC.exe
Token: 33	604	WMIC.exe
Token: 34	604	WMIC.exe
Token: 35	604	WMIC.exe
Token: SeIncreaseQuotaPrivilege	604	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2060	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	31
PID 2632 wrote to memory of 2060	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	31
PID 2632 wrote to memory of 2060	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	31
PID 2632 wrote to memory of 2060	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	31
PID 2060 wrote to memory of 2484	2060	cmd.exe	33
PID 2060 wrote to memory of 2484	2060	cmd.exe	33
PID 2060 wrote to memory of 2484	2060	cmd.exe	33
PID 2632 wrote to memory of 268	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	34
PID 2632 wrote to memory of 268	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	34
PID 2632 wrote to memory of 268	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	34
PID 2632 wrote to memory of 268	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	34
PID 268 wrote to memory of 604	268	cmd.exe	36
PID 268 wrote to memory of 604	268	cmd.exe	36
PID 268 wrote to memory of 604	268	cmd.exe	36
PID 2632 wrote to memory of 2892	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	37
PID 2632 wrote to memory of 2892	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	37
PID 2632 wrote to memory of 2892	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	37
PID 2632 wrote to memory of 2892	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	37
PID 2892 wrote to memory of 3060	2892	cmd.exe	39
PID 2892 wrote to memory of 3060	2892	cmd.exe	39
PID 2892 wrote to memory of 3060	2892	cmd.exe	39
PID 2632 wrote to memory of 3008	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	40
PID 2632 wrote to memory of 3008	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	40
PID 2632 wrote to memory of 3008	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	40
PID 2632 wrote to memory of 3008	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	40
PID 3008 wrote to memory of 2480	3008	cmd.exe	42
PID 3008 wrote to memory of 2480	3008	cmd.exe	42
PID 3008 wrote to memory of 2480	3008	cmd.exe	42
PID 2632 wrote to memory of 2228	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	43
PID 2632 wrote to memory of 2228	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	43
PID 2632 wrote to memory of 2228	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	43
PID 2632 wrote to memory of 2228	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	43
PID 2228 wrote to memory of 1240	2228	cmd.exe	45
PID 2228 wrote to memory of 1240	2228	cmd.exe	45
PID 2228 wrote to memory of 1240	2228	cmd.exe	45
PID 2632 wrote to memory of 2512	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	46
PID 2632 wrote to memory of 2512	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	46
PID 2632 wrote to memory of 2512	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	46
PID 2632 wrote to memory of 2512	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	46
PID 2512 wrote to memory of 2796	2512	cmd.exe	48
PID 2512 wrote to memory of 2796	2512	cmd.exe	48
PID 2512 wrote to memory of 2796	2512	cmd.exe	48
PID 2632 wrote to memory of 2840	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	49
PID 2632 wrote to memory of 2840	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	49
PID 2632 wrote to memory of 2840	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	49
PID 2632 wrote to memory of 2840	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	49
PID 2840 wrote to memory of 1200	2840	cmd.exe	51
PID 2840 wrote to memory of 1200	2840	cmd.exe	51
PID 2840 wrote to memory of 1200	2840	cmd.exe	51
PID 2632 wrote to memory of 2740	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	52
PID 2632 wrote to memory of 2740	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	52
PID 2632 wrote to memory of 2740	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	52
PID 2632 wrote to memory of 2740	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	52
PID 2740 wrote to memory of 1620	2740	cmd.exe	54
PID 2740 wrote to memory of 1620	2740	cmd.exe	54
PID 2740 wrote to memory of 1620	2740	cmd.exe	54
PID 2632 wrote to memory of 1344	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	55
PID 2632 wrote to memory of 1344	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	55
PID 2632 wrote to memory of 1344	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	55
PID 2632 wrote to memory of 1344	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	55
PID 1344 wrote to memory of 1680	1344	cmd.exe	57
PID 1344 wrote to memory of 1680	1344	cmd.exe	57
PID 1344 wrote to memory of 1680	1344	cmd.exe	57
PID 2632 wrote to memory of 2240	2632	41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe	60

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe
"C:\Users\Admin\AppData\Local\Temp\41896f40197a6160fcab046b5fc63a36d0805dbb1ca5a03af35b92b27d9a0eb5.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1FFFE2A-FCA2-46FB-AB3E-856A1E7D212E}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1FFFE2A-FCA2-46FB-AB3E-856A1E7D212E}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0FC48C72-9C18-47C6-8B58-44674A6F05C7}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0FC48C72-9C18-47C6-8B58-44674A6F05C7}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:604
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{204EE53C-B0C6-465C-A10E-C7D01BB1DC56}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{204EE53C-B0C6-465C-A10E-C7D01BB1DC56}'" delete
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EBE0BD6A-49EE-4877-9DF3-2402C31847DC}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EBE0BD6A-49EE-4877-9DF3-2402C31847DC}'" delete
    3⤵
    PID:2480
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9F15D746-ED0B-4572-94AE-1166A292DB55}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9F15D746-ED0B-4572-94AE-1166A292DB55}'" delete
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A07542A-1109-4887-882A-BF29A37D8CD5}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A07542A-1109-4887-882A-BF29A37D8CD5}'" delete
    3⤵
    PID:2796
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2AF7EC3A-8A71-4E82-A340-0C14FAF5465F}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2AF7EC3A-8A71-4E82-A340-0C14FAF5465F}'" delete
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1DFBBAE0-E294-4355-95C6-36BFB92E0C52}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1DFBBAE0-E294-4355-95C6-36BFB92E0C52}'" delete
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4095CEB-C8A5-4EF2-B87A-10A0EE0A7922}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C4095CEB-C8A5-4EF2-B87A-10A0EE0A7922}'" delete
    3⤵
    PID:1680
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68599A65-ABD7-47E8-9515-79BD8AE1303A}'" delete
  2⤵
  PID:2240
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68599A65-ABD7-47E8-9515-79BD8AE1303A}'" delete
    3⤵
    PID:2172
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{91297E19-2CAD-413F-A07A-377C39D7CDFE}'" delete
  2⤵
  PID:2148
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{91297E19-2CAD-413F-A07A-377C39D7CDFE}'" delete
    3⤵
    PID:552
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4C666236-5F6A-4AEB-853C-1D58C067D79C}'" delete
  2⤵
  PID:1900
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4C666236-5F6A-4AEB-853C-1D58C067D79C}'" delete
    3⤵
    PID:284
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45A30E27-E172-4F14-BA8C-41653AB26A7F}'" delete
  2⤵
  PID:2104
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45A30E27-E172-4F14-BA8C-41653AB26A7F}'" delete
    3⤵
    PID:1428
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3A6DF31-F853-49AE-8216-CCA97D39DF0D}'" delete
  2⤵
  PID:900
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3A6DF31-F853-49AE-8216-CCA97D39DF0D}'" delete
    3⤵
    PID:1764
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1706141-E98C-4DD8-B93C-0DF9ACA0A9B6}'" delete
  2⤵
  PID:1256
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A1706141-E98C-4DD8-B93C-0DF9ACA0A9B6}'" delete
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A32BE965-B73A-4EA7-8E0B-7DBEE93FB2E5}'" delete
  2⤵
  PID:808
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A32BE965-B73A-4EA7-8E0B-7DBEE93FB2E5}'" delete
    3⤵
    PID:912
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{836E661F-607C-451E-A4A6-8F8E4A56E87A}'" delete
  2⤵
  PID:2296
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{836E661F-607C-451E-A4A6-8F8E4A56E87A}'" delete
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FF70A0D6-E5D2-4C1C-817F-7E56D7E90DC7}'" delete
  2⤵
  PID:800
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FF70A0D6-E5D2-4C1C-817F-7E56D7E90DC7}'" delete
    3⤵
    PID:1464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
0ff023d9e019bb28379a77375272c2ee

SHA1
3c380eadd80214eaba0dfb65ae9e2be962fbefff

SHA256
59b5cf7e0c7fc4dec3122b6047814b4a01c6652598f9f58ee85451211d48b5e0

SHA512
44980825a0056c0d4805e1f13cb2d0c247271cd66344dd571cb6390ec16899363cfdee05e3b693b7bbd3ea4948d376ed91ee515d88c68607b737d9332a4f3cf6

Download Submit
memory/2632-9-0x000000007EF70000-0x000000007EFA4000-memory.dmp

Filesize
208KB

Download
memory/2632-1-0x000000007EF70000-0x000000007EFA4000-memory.dmp

Filesize
208KB

Download
memory/2632-17-0x000000007EF70000-0x000000007EFA4000-memory.dmp

Filesize
208KB

Download
memory/2632-481-0x000000007EF70000-0x000000007EFA4000-memory.dmp

Filesize
208KB

Download
memory/2632-1431-0x000000007EF70000-0x000000007EFA4000-memory.dmp

Filesize
208KB

Download
memory/2632-1437-0x000000007EF70000-0x000000007EFA4000-memory.dmp

Filesize
208KB

Download
memory/2632-1439-0x000000007EF70000-0x000000007EFA4000-memory.dmp

Filesize
208KB

Download