Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe
Resource
win10v2004-20240426-en
General
-
Target
e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe
-
Size
473KB
-
MD5
5dd814636f034cca43d05bd92c493176
-
SHA1
c3e40e07bab8fcdc5030883cd2557ba4bf0d0f32
-
SHA256
e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219
-
SHA512
49a38d6664e4251bbd8f1a8db9d3568fcee7033f94e5e04ea8cafa4e949d81e31dc94bb2d66a827f8a5870d4c351c644e3d67e20df75cf77a0aec54f67e3f583
-
SSDEEP
6144:lDRVAtdEj1hVuEx8imwetoxktt9IIhj8nJtkx9JUvcmlVs0OmnG38/c9Hg:GuhVuEx7OoxkttGIx8HlCBX3
Malware Config
Extracted
C:\ProgramData\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7370) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 31 IoCs
description ioc Process File opened for modification C:\Users\Public\AccountPictures\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\Desktop\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\Documents\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\Pictures\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Music\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\Videos\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Searches\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Documents\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Links\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Videos\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\Music\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\Downloads\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Public\Libraries\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-pl.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\fi-fi\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PAPYRUS.TTF e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ar-ae\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\nb.pak e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\autofill_labeling_features.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fill-sign-2x.png e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_18.svg e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\de-de\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul-oob.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Keywords.HxK e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fi-fi\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Social e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\qu.pak.DATA e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-down_32.svg e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-pl.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\TestRedo.contact e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons.png e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\es.pak e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\readme.txt e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 2592 vssvc.exe Token: SeRestorePrivilege 2592 vssvc.exe Token: SeAuditPrivilege 2592 vssvc.exe Token: SeIncreaseQuotaPrivilege 876 WMIC.exe Token: SeSecurityPrivilege 876 WMIC.exe Token: SeTakeOwnershipPrivilege 876 WMIC.exe Token: SeLoadDriverPrivilege 876 WMIC.exe Token: SeSystemProfilePrivilege 876 WMIC.exe Token: SeSystemtimePrivilege 876 WMIC.exe Token: SeProfSingleProcessPrivilege 876 WMIC.exe Token: SeIncBasePriorityPrivilege 876 WMIC.exe Token: SeCreatePagefilePrivilege 876 WMIC.exe Token: SeBackupPrivilege 876 WMIC.exe Token: SeRestorePrivilege 876 WMIC.exe Token: SeShutdownPrivilege 876 WMIC.exe Token: SeDebugPrivilege 876 WMIC.exe Token: SeSystemEnvironmentPrivilege 876 WMIC.exe Token: SeRemoteShutdownPrivilege 876 WMIC.exe Token: SeUndockPrivilege 876 WMIC.exe Token: SeManageVolumePrivilege 876 WMIC.exe Token: 33 876 WMIC.exe Token: 34 876 WMIC.exe Token: 35 876 WMIC.exe Token: 36 876 WMIC.exe Token: SeIncreaseQuotaPrivilege 876 WMIC.exe Token: SeSecurityPrivilege 876 WMIC.exe Token: SeTakeOwnershipPrivilege 876 WMIC.exe Token: SeLoadDriverPrivilege 876 WMIC.exe Token: SeSystemProfilePrivilege 876 WMIC.exe Token: SeSystemtimePrivilege 876 WMIC.exe Token: SeProfSingleProcessPrivilege 876 WMIC.exe Token: SeIncBasePriorityPrivilege 876 WMIC.exe Token: SeCreatePagefilePrivilege 876 WMIC.exe Token: SeBackupPrivilege 876 WMIC.exe Token: SeRestorePrivilege 876 WMIC.exe Token: SeShutdownPrivilege 876 WMIC.exe Token: SeDebugPrivilege 876 WMIC.exe Token: SeSystemEnvironmentPrivilege 876 WMIC.exe Token: SeRemoteShutdownPrivilege 876 WMIC.exe Token: SeUndockPrivilege 876 WMIC.exe Token: SeManageVolumePrivilege 876 WMIC.exe Token: 33 876 WMIC.exe Token: 34 876 WMIC.exe Token: 35 876 WMIC.exe Token: 36 876 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3716 wrote to memory of 4468 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 88 PID 3716 wrote to memory of 4468 3716 e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe 88 PID 4468 wrote to memory of 876 4468 cmd.exe 90 PID 4468 wrote to memory of 876 4468 cmd.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe"C:\Users\Admin\AppData\Local\Temp\e27ef38f995ea3a2a1ebd7f686adb0a699f3fe893d942967b78bdf71f0095219.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B2A6821F-D54A-439F-803F-E4568801725A}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B2A6821F-D54A-439F-803F-E4568801725A}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502aca66083f85518ca1ac4bb688e7b4f
SHA18b6dab3ceb858ce768bc4d584597605dae5963cc
SHA25660b63e95a062a9ac3694683db5f6b72f60856073f66a402558152ed5b34d2dd8
SHA512304e6827421e72c614e69006eafa7b8863446980351d4875fb733b6388aee8787b08b87afee194988dbadf0a2d620ac3db3836f70b9e1eb271c23fa0f354de39