Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe
Resource
win10v2004-20240508-en
General
-
Target
fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe
-
Size
393KB
-
MD5
95ce99000c3a322af715990e8834f05e
-
SHA1
3f3404787bc6ccbb562c5bed2fc93d04faed2174
-
SHA256
fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b
-
SHA512
b425fb79eb1011d5fdd98f4373f7ff1cd5905b4218d66df6b343a5334f48b8d3eaf32d398b9826cb1ab6b1afc104b0498be4351aa8c1911ad13dab709880b146
-
SSDEEP
6144:+VaIrNO6oBcW5QW/nRx7+mA1cHEDy8Chy1DGOQ9mYoZwFLIDXPbrXckXcx3:6r+qRW/KmWcHQZGOmmYoeFLWbrc1
Malware Config
Extracted
C:\Program Files (x86)\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7970) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 46 IoCs
description ioc Process File opened for modification C:\Users\Admin\Music\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Libraries\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Downloads\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Videos\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EQ2PZD61\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Documents\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Desktop\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\2RM92H5V\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BB4W7M7Z\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Links\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Documents\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Music\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\JWM3U1DD\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Pictures\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Searches\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Admin\Videos\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212299.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files\DVD Maker\es-ES\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WSIDBR98.POC fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_OFF.GIF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106816.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RE00006_.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\UTILITY.ACCDA fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Solstice.thmx fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBOX.DPV fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files\VideoLAN\VLC\locale\ga\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB2B.BDR fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382968.JPG fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\SUMIPNTG.INF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0291984.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182946.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099181.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198377.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OnLineIdle.ico fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\RECYCLE.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Tripoli fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02356_.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR41F.GIF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME06.CSS fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\readme.txt fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152698.WMF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01842_.GIF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR41F.GIF fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2652 vssvc.exe Token: SeRestorePrivilege 2652 vssvc.exe Token: SeAuditPrivilege 2652 vssvc.exe Token: SeIncreaseQuotaPrivilege 2664 WMIC.exe Token: SeSecurityPrivilege 2664 WMIC.exe Token: SeTakeOwnershipPrivilege 2664 WMIC.exe Token: SeLoadDriverPrivilege 2664 WMIC.exe Token: SeSystemProfilePrivilege 2664 WMIC.exe Token: SeSystemtimePrivilege 2664 WMIC.exe Token: SeProfSingleProcessPrivilege 2664 WMIC.exe Token: SeIncBasePriorityPrivilege 2664 WMIC.exe Token: SeCreatePagefilePrivilege 2664 WMIC.exe Token: SeBackupPrivilege 2664 WMIC.exe Token: SeRestorePrivilege 2664 WMIC.exe Token: SeShutdownPrivilege 2664 WMIC.exe Token: SeDebugPrivilege 2664 WMIC.exe Token: SeSystemEnvironmentPrivilege 2664 WMIC.exe Token: SeRemoteShutdownPrivilege 2664 WMIC.exe Token: SeUndockPrivilege 2664 WMIC.exe Token: SeManageVolumePrivilege 2664 WMIC.exe Token: 33 2664 WMIC.exe Token: 34 2664 WMIC.exe Token: 35 2664 WMIC.exe Token: SeIncreaseQuotaPrivilege 2664 WMIC.exe Token: SeSecurityPrivilege 2664 WMIC.exe Token: SeTakeOwnershipPrivilege 2664 WMIC.exe Token: SeLoadDriverPrivilege 2664 WMIC.exe Token: SeSystemProfilePrivilege 2664 WMIC.exe Token: SeSystemtimePrivilege 2664 WMIC.exe Token: SeProfSingleProcessPrivilege 2664 WMIC.exe Token: SeIncBasePriorityPrivilege 2664 WMIC.exe Token: SeCreatePagefilePrivilege 2664 WMIC.exe Token: SeBackupPrivilege 2664 WMIC.exe Token: SeRestorePrivilege 2664 WMIC.exe Token: SeShutdownPrivilege 2664 WMIC.exe Token: SeDebugPrivilege 2664 WMIC.exe Token: SeSystemEnvironmentPrivilege 2664 WMIC.exe Token: SeRemoteShutdownPrivilege 2664 WMIC.exe Token: SeUndockPrivilege 2664 WMIC.exe Token: SeManageVolumePrivilege 2664 WMIC.exe Token: 33 2664 WMIC.exe Token: 34 2664 WMIC.exe Token: 35 2664 WMIC.exe Token: SeIncreaseQuotaPrivilege 2444 WMIC.exe Token: SeSecurityPrivilege 2444 WMIC.exe Token: SeTakeOwnershipPrivilege 2444 WMIC.exe Token: SeLoadDriverPrivilege 2444 WMIC.exe Token: SeSystemProfilePrivilege 2444 WMIC.exe Token: SeSystemtimePrivilege 2444 WMIC.exe Token: SeProfSingleProcessPrivilege 2444 WMIC.exe Token: SeIncBasePriorityPrivilege 2444 WMIC.exe Token: SeCreatePagefilePrivilege 2444 WMIC.exe Token: SeBackupPrivilege 2444 WMIC.exe Token: SeRestorePrivilege 2444 WMIC.exe Token: SeShutdownPrivilege 2444 WMIC.exe Token: SeDebugPrivilege 2444 WMIC.exe Token: SeSystemEnvironmentPrivilege 2444 WMIC.exe Token: SeRemoteShutdownPrivilege 2444 WMIC.exe Token: SeUndockPrivilege 2444 WMIC.exe Token: SeManageVolumePrivilege 2444 WMIC.exe Token: 33 2444 WMIC.exe Token: 34 2444 WMIC.exe Token: 35 2444 WMIC.exe Token: SeIncreaseQuotaPrivilege 2444 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2736 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 31 PID 1984 wrote to memory of 2736 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 31 PID 1984 wrote to memory of 2736 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 31 PID 1984 wrote to memory of 2736 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 31 PID 2736 wrote to memory of 2664 2736 cmd.exe 33 PID 2736 wrote to memory of 2664 2736 cmd.exe 33 PID 2736 wrote to memory of 2664 2736 cmd.exe 33 PID 1984 wrote to memory of 2220 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 34 PID 1984 wrote to memory of 2220 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 34 PID 1984 wrote to memory of 2220 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 34 PID 1984 wrote to memory of 2220 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 34 PID 2220 wrote to memory of 2444 2220 cmd.exe 36 PID 2220 wrote to memory of 2444 2220 cmd.exe 36 PID 2220 wrote to memory of 2444 2220 cmd.exe 36 PID 1984 wrote to memory of 2528 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 37 PID 1984 wrote to memory of 2528 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 37 PID 1984 wrote to memory of 2528 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 37 PID 1984 wrote to memory of 2528 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 37 PID 2528 wrote to memory of 2864 2528 cmd.exe 39 PID 2528 wrote to memory of 2864 2528 cmd.exe 39 PID 2528 wrote to memory of 2864 2528 cmd.exe 39 PID 1984 wrote to memory of 1268 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 40 PID 1984 wrote to memory of 1268 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 40 PID 1984 wrote to memory of 1268 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 40 PID 1984 wrote to memory of 1268 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 40 PID 1268 wrote to memory of 2420 1268 cmd.exe 42 PID 1268 wrote to memory of 2420 1268 cmd.exe 42 PID 1268 wrote to memory of 2420 1268 cmd.exe 42 PID 1984 wrote to memory of 2424 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 43 PID 1984 wrote to memory of 2424 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 43 PID 1984 wrote to memory of 2424 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 43 PID 1984 wrote to memory of 2424 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 43 PID 2424 wrote to memory of 1504 2424 cmd.exe 45 PID 2424 wrote to memory of 1504 2424 cmd.exe 45 PID 2424 wrote to memory of 1504 2424 cmd.exe 45 PID 1984 wrote to memory of 2740 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 46 PID 1984 wrote to memory of 2740 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 46 PID 1984 wrote to memory of 2740 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 46 PID 1984 wrote to memory of 2740 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 46 PID 2740 wrote to memory of 1816 2740 cmd.exe 48 PID 2740 wrote to memory of 1816 2740 cmd.exe 48 PID 2740 wrote to memory of 1816 2740 cmd.exe 48 PID 1984 wrote to memory of 2356 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 49 PID 1984 wrote to memory of 2356 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 49 PID 1984 wrote to memory of 2356 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 49 PID 1984 wrote to memory of 2356 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 49 PID 2356 wrote to memory of 1656 2356 cmd.exe 51 PID 2356 wrote to memory of 1656 2356 cmd.exe 51 PID 2356 wrote to memory of 1656 2356 cmd.exe 51 PID 1984 wrote to memory of 1680 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 52 PID 1984 wrote to memory of 1680 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 52 PID 1984 wrote to memory of 1680 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 52 PID 1984 wrote to memory of 1680 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 52 PID 1680 wrote to memory of 884 1680 cmd.exe 54 PID 1680 wrote to memory of 884 1680 cmd.exe 54 PID 1680 wrote to memory of 884 1680 cmd.exe 54 PID 1984 wrote to memory of 1864 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 55 PID 1984 wrote to memory of 1864 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 55 PID 1984 wrote to memory of 1864 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 55 PID 1984 wrote to memory of 1864 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 55 PID 1864 wrote to memory of 2960 1864 cmd.exe 57 PID 1864 wrote to memory of 2960 1864 cmd.exe 57 PID 1864 wrote to memory of 2960 1864 cmd.exe 57 PID 1984 wrote to memory of 1516 1984 fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe 58 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe"C:\Users\Admin\AppData\Local\Temp\fa425f2ca9792db53f2304128aa7a8b05fa1f8811c059e69c3eb08ea7808ec3b.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7C723A81-2FA2-4A6E-A4DA-8D6EF87E0B1F}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7C723A81-2FA2-4A6E-A4DA-8D6EF87E0B1F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{57BEDE43-77B7-4222-9709-2B024372CBCB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{57BEDE43-77B7-4222-9709-2B024372CBCB}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AF0FCBC7-3702-40F4-BBC1-21C52D8CC939}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AF0FCBC7-3702-40F4-BBC1-21C52D8CC939}'" delete3⤵PID:2864
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EE6266B5-3167-4918-9296-4477BB59B8AB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EE6266B5-3167-4918-9296-4477BB59B8AB}'" delete3⤵PID:2420
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FBA5A9A-50A6-47F7-BDBC-47EF8FBA81A2}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FBA5A9A-50A6-47F7-BDBC-47EF8FBA81A2}'" delete3⤵PID:1504
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4B995CF0-BADA-4343-9B10-634D76D10EF6}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4B995CF0-BADA-4343-9B10-634D76D10EF6}'" delete3⤵PID:1816
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E92435FA-DEA6-45A9-A934-36C3B8C6ACDD}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E92435FA-DEA6-45A9-A934-36C3B8C6ACDD}'" delete3⤵PID:1656
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A3EAFBC9-1B53-4C05-815F-923F1F8694DC}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A3EAFBC9-1B53-4C05-815F-923F1F8694DC}'" delete3⤵PID:884
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AA689B5F-5A26-4DF1-8A57-B3D8C9B09B40}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{AA689B5F-5A26-4DF1-8A57-B3D8C9B09B40}'" delete3⤵PID:2960
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C3FBB331-3F55-4B9A-91AA-E30A5490D8F4}'" delete2⤵PID:1516
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C3FBB331-3F55-4B9A-91AA-E30A5490D8F4}'" delete3⤵PID:1348
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A4A990A6-5095-4AD9-974F-E8569C8E62ED}'" delete2⤵PID:1304
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A4A990A6-5095-4AD9-974F-E8569C8E62ED}'" delete3⤵PID:2396
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{948611A3-C8A3-4765-BDBA-3DC497DB3417}'" delete2⤵PID:2120
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{948611A3-C8A3-4765-BDBA-3DC497DB3417}'" delete3⤵PID:2428
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0ADCB347-E66D-4A85-997B-BC5A52A9EFB5}'" delete2⤵PID:2164
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0ADCB347-E66D-4A85-997B-BC5A52A9EFB5}'" delete3⤵PID:2812
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D9E1EA9B-2F48-4AF1-AFB5-56C43E01F980}'" delete2⤵PID:596
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D9E1EA9B-2F48-4AF1-AFB5-56C43E01F980}'" delete3⤵PID:488
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{49905140-79A4-473B-BF11-3B0735C67D78}'" delete2⤵PID:616
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{49905140-79A4-473B-BF11-3B0735C67D78}'" delete3⤵PID:1488
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4B6CB57F-ED37-4B8D-8C34-7EF245B54B09}'" delete2⤵PID:1684
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4B6CB57F-ED37-4B8D-8C34-7EF245B54B09}'" delete3⤵PID:2180
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A58497F5-7047-4A89-A7B8-DEE91AA870C8}'" delete2⤵PID:452
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A58497F5-7047-4A89-A7B8-DEE91AA870C8}'" delete3⤵PID:2064
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{43576151-6D96-44F5-9042-C5B27E5434A6}'" delete2⤵PID:836
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{43576151-6D96-44F5-9042-C5B27E5434A6}'" delete3⤵PID:1788
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5663cc7c962678b552aaa2736a3f7748e
SHA166928361cd188c9c05a21e278c574249185af173
SHA2564de07a4d52182c55466dec7278d8801d656ea1b99dcc3ae3e8d08b05f4db72c5
SHA51291cfdd4c717a49e098c982c3829a4919bd984d367050ff14fb3b303bcd8a78d7344efa8097b372e17c94e4dfbc38062e1a126d1d07ee029fe10b338b9930933e