Analysis
-
max time kernel
62s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-09-2024 15:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe
-
Size
515KB
-
MD5
83848a20f22e2db86b700520b5c3af69
-
SHA1
71c1d23dd905ae91183d61d6f703fb803b5c3926
-
SHA256
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6
-
SHA512
b1f9cd195e3ec3144efdf132a2a34bc59ad41309cd29cfc7625b8fcf30f18e5a540a203b6f17c75332c25af70019c4f3a7619e4db3b0ad2e7d7743a2a6233876
-
SSDEEP
3072:uPaYEBc2jrORnQssIJkP52+JKY8/d7epmB98g89QP2EKO0+5Wk29YKvaEAJ:zYEBc2jMQsdJkQ+J+/dB9rP2v+5RS
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI strain.
As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly.
If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value.
To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.xyz/
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible.
---BEGIN ID---
ec5sSORrGN3JYtjUtK7QvDv7ZtnFwgcUnCEmqJITc9YfyoAPydlyCoE1FHyB8wCq
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz/
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Drops file in Program Files directory 57 IoCs
Processes:
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exedescription ioc Process File opened for modification C:\Program Files\SendRepair.M2T f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\directshowtap.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Microsoft Games\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\OpenDeny.WTV f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Mozilla Firefox\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\CompleteRestore.odt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\LockPop.xps f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\ReadEdit.rtf f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Common Files\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Google\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\CompareClear.mid f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\OpenReceive.php f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\descript.ion f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\ConvertToTrace.jfif f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\ExportEnter.midi f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\StartComplete.docx f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\SplitRemove.bmp f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\BlockConvertFrom.dxf f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\CloseTest.eprtx f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\SwitchClose.snd f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\DVD Maker\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\omni.ja f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DismountConnect.css f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\ProtectClose.contact f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\UnblockRestore.dotm f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\HideRegister.xlsm f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\7z.sfx f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\License.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\install.log f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\GroupInitialize.xla f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Microsoft Office\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\7-Zip\History.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\offset.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\RestartResume.rtf f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files (x86)\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Java\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\bod_r.TTF f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File created C:\Program Files\Internet Explorer\readme.txt f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2984 1288 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exepid Process 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid Process Token: SeBackupPrivilege 2756 vssvc.exe Token: SeRestorePrivilege 2756 vssvc.exe Token: SeAuditPrivilege 2756 vssvc.exe Token: SeIncreaseQuotaPrivilege 2936 WMIC.exe Token: SeSecurityPrivilege 2936 WMIC.exe Token: SeTakeOwnershipPrivilege 2936 WMIC.exe Token: SeLoadDriverPrivilege 2936 WMIC.exe Token: SeSystemProfilePrivilege 2936 WMIC.exe Token: SeSystemtimePrivilege 2936 WMIC.exe Token: SeProfSingleProcessPrivilege 2936 WMIC.exe Token: SeIncBasePriorityPrivilege 2936 WMIC.exe Token: SeCreatePagefilePrivilege 2936 WMIC.exe Token: SeBackupPrivilege 2936 WMIC.exe Token: SeRestorePrivilege 2936 WMIC.exe Token: SeShutdownPrivilege 2936 WMIC.exe Token: SeDebugPrivilege 2936 WMIC.exe Token: SeSystemEnvironmentPrivilege 2936 WMIC.exe Token: SeRemoteShutdownPrivilege 2936 WMIC.exe Token: SeUndockPrivilege 2936 WMIC.exe Token: SeManageVolumePrivilege 2936 WMIC.exe Token: 33 2936 WMIC.exe Token: 34 2936 WMIC.exe Token: 35 2936 WMIC.exe Token: SeIncreaseQuotaPrivilege 2936 WMIC.exe Token: SeSecurityPrivilege 2936 WMIC.exe Token: SeTakeOwnershipPrivilege 2936 WMIC.exe Token: SeLoadDriverPrivilege 2936 WMIC.exe Token: SeSystemProfilePrivilege 2936 WMIC.exe Token: SeSystemtimePrivilege 2936 WMIC.exe Token: SeProfSingleProcessPrivilege 2936 WMIC.exe Token: SeIncBasePriorityPrivilege 2936 WMIC.exe Token: SeCreatePagefilePrivilege 2936 WMIC.exe Token: SeBackupPrivilege 2936 WMIC.exe Token: SeRestorePrivilege 2936 WMIC.exe Token: SeShutdownPrivilege 2936 WMIC.exe Token: SeDebugPrivilege 2936 WMIC.exe Token: SeSystemEnvironmentPrivilege 2936 WMIC.exe Token: SeRemoteShutdownPrivilege 2936 WMIC.exe Token: SeUndockPrivilege 2936 WMIC.exe Token: SeManageVolumePrivilege 2936 WMIC.exe Token: 33 2936 WMIC.exe Token: 34 2936 WMIC.exe Token: 35 2936 WMIC.exe Token: SeIncreaseQuotaPrivilege 2624 WMIC.exe Token: SeSecurityPrivilege 2624 WMIC.exe Token: SeTakeOwnershipPrivilege 2624 WMIC.exe Token: SeLoadDriverPrivilege 2624 WMIC.exe Token: SeSystemProfilePrivilege 2624 WMIC.exe Token: SeSystemtimePrivilege 2624 WMIC.exe Token: SeProfSingleProcessPrivilege 2624 WMIC.exe Token: SeIncBasePriorityPrivilege 2624 WMIC.exe Token: SeCreatePagefilePrivilege 2624 WMIC.exe Token: SeBackupPrivilege 2624 WMIC.exe Token: SeRestorePrivilege 2624 WMIC.exe Token: SeShutdownPrivilege 2624 WMIC.exe Token: SeDebugPrivilege 2624 WMIC.exe Token: SeSystemEnvironmentPrivilege 2624 WMIC.exe Token: SeRemoteShutdownPrivilege 2624 WMIC.exe Token: SeUndockPrivilege 2624 WMIC.exe Token: SeManageVolumePrivilege 2624 WMIC.exe Token: 33 2624 WMIC.exe Token: 34 2624 WMIC.exe Token: 35 2624 WMIC.exe Token: SeIncreaseQuotaPrivilege 2624 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 1288 wrote to memory of 2988 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 32 PID 1288 wrote to memory of 2988 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 32 PID 1288 wrote to memory of 2988 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 32 PID 1288 wrote to memory of 2988 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 32 PID 2988 wrote to memory of 2936 2988 cmd.exe 34 PID 2988 wrote to memory of 2936 2988 cmd.exe 34 PID 2988 wrote to memory of 2936 2988 cmd.exe 34 PID 1288 wrote to memory of 2744 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 35 PID 1288 wrote to memory of 2744 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 35 PID 1288 wrote to memory of 2744 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 35 PID 1288 wrote to memory of 2744 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 35 PID 2744 wrote to memory of 2624 2744 cmd.exe 37 PID 2744 wrote to memory of 2624 2744 cmd.exe 37 PID 2744 wrote to memory of 2624 2744 cmd.exe 37 PID 1288 wrote to memory of 2708 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 38 PID 1288 wrote to memory of 2708 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 38 PID 1288 wrote to memory of 2708 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 38 PID 1288 wrote to memory of 2708 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 38 PID 2708 wrote to memory of 1708 2708 cmd.exe 40 PID 2708 wrote to memory of 1708 2708 cmd.exe 40 PID 2708 wrote to memory of 1708 2708 cmd.exe 40 PID 1288 wrote to memory of 108 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 41 PID 1288 wrote to memory of 108 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 41 PID 1288 wrote to memory of 108 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 41 PID 1288 wrote to memory of 108 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 41 PID 108 wrote to memory of 1748 108 cmd.exe 43 PID 108 wrote to memory of 1748 108 cmd.exe 43 PID 108 wrote to memory of 1748 108 cmd.exe 43 PID 1288 wrote to memory of 2548 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 44 PID 1288 wrote to memory of 2548 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 44 PID 1288 wrote to memory of 2548 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 44 PID 1288 wrote to memory of 2548 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 44 PID 2548 wrote to memory of 940 2548 cmd.exe 46 PID 2548 wrote to memory of 940 2548 cmd.exe 46 PID 2548 wrote to memory of 940 2548 cmd.exe 46 PID 1288 wrote to memory of 2348 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 47 PID 1288 wrote to memory of 2348 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 47 PID 1288 wrote to memory of 2348 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 47 PID 1288 wrote to memory of 2348 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 47 PID 2348 wrote to memory of 2852 2348 cmd.exe 49 PID 2348 wrote to memory of 2852 2348 cmd.exe 49 PID 2348 wrote to memory of 2852 2348 cmd.exe 49 PID 1288 wrote to memory of 2344 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 50 PID 1288 wrote to memory of 2344 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 50 PID 1288 wrote to memory of 2344 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 50 PID 1288 wrote to memory of 2344 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 50 PID 2344 wrote to memory of 2692 2344 cmd.exe 52 PID 2344 wrote to memory of 2692 2344 cmd.exe 52 PID 2344 wrote to memory of 2692 2344 cmd.exe 52 PID 1288 wrote to memory of 1144 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 53 PID 1288 wrote to memory of 1144 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 53 PID 1288 wrote to memory of 1144 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 53 PID 1288 wrote to memory of 1144 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 53 PID 1144 wrote to memory of 2880 1144 cmd.exe 55 PID 1144 wrote to memory of 2880 1144 cmd.exe 55 PID 1144 wrote to memory of 2880 1144 cmd.exe 55 PID 1288 wrote to memory of 2968 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 56 PID 1288 wrote to memory of 2968 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 56 PID 1288 wrote to memory of 2968 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 56 PID 1288 wrote to memory of 2968 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 56 PID 2968 wrote to memory of 1064 2968 cmd.exe 58 PID 2968 wrote to memory of 1064 2968 cmd.exe 58 PID 2968 wrote to memory of 1064 2968 cmd.exe 58 PID 1288 wrote to memory of 2424 1288 f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe 59 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe"C:\Users\Admin\AppData\Local\Temp\f218bd818d6ed55f2db6d7907d8c03040d1c8f71841e5b5a46e90531cc77f5d6.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7AA3892-E0EC-457B-8FC5-DF358387B5BE}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7AA3892-E0EC-457B-8FC5-DF358387B5BE}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CDB775E-A5D6-452B-A56A-BA620E0F7BFD}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CDB775E-A5D6-452B-A56A-BA620E0F7BFD}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C1EF448-F6DA-47B6-A3EB-8C0870C4A941}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C1EF448-F6DA-47B6-A3EB-8C0870C4A941}'" delete3⤵PID:1708
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{494C03C6-B7B7-4DF1-8FA1-7D53E03DDA63}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{494C03C6-B7B7-4DF1-8FA1-7D53E03DDA63}'" delete3⤵PID:1748
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F47BA72D-84E4-4D7E-BDAB-96318230ABB7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F47BA72D-84E4-4D7E-BDAB-96318230ABB7}'" delete3⤵PID:940
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8235A2B2-EED6-4D84-9B47-CD02BB13E9C1}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8235A2B2-EED6-4D84-9B47-CD02BB13E9C1}'" delete3⤵PID:2852
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E6CBF7-34AA-420A-ACFA-78E6B16AD8C2}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E6CBF7-34AA-420A-ACFA-78E6B16AD8C2}'" delete3⤵PID:2692
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3CBCFC55-5255-4E65-8C94-0A792EA482BB}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3CBCFC55-5255-4E65-8C94-0A792EA482BB}'" delete3⤵PID:2880
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45E828E2-3C55-49F9-825B-E01046E2A113}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45E828E2-3C55-49F9-825B-E01046E2A113}'" delete3⤵PID:1064
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76239064-3F5F-4D70-92A4-670F55591560}'" delete2⤵PID:2424
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76239064-3F5F-4D70-92A4-670F55591560}'" delete3⤵PID:752
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B4EF978-E9B0-41CF-AAE2-776E38E9EDCE}'" delete2⤵PID:2360
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B4EF978-E9B0-41CF-AAE2-776E38E9EDCE}'" delete3⤵PID:1116
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C840305C-0D8E-4B8B-BC6D-4003520487F0}'" delete2⤵PID:3056
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C840305C-0D8E-4B8B-BC6D-4003520487F0}'" delete3⤵PID:2428
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{048EB31A-BA93-40FE-9759-479CEEF5F9AF}'" delete2⤵PID:2372
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{048EB31A-BA93-40FE-9759-479CEEF5F9AF}'" delete3⤵PID:2160
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469E3BBE-F71A-45E0-BD8F-4D2DC75A9037}'" delete2⤵PID:2156
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469E3BBE-F71A-45E0-BD8F-4D2DC75A9037}'" delete3⤵PID:1828
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5E3EA6-3B5A-47E4-BB20-CAD4E6A45BA5}'" delete2⤵PID:1752
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5E3EA6-3B5A-47E4-BB20-CAD4E6A45BA5}'" delete3⤵PID:1168
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6FD06C77-DFAC-4B42-A173-D0BD649CD10A}'" delete2⤵PID:2016
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6FD06C77-DFAC-4B42-A173-D0BD649CD10A}'" delete3⤵PID:1524
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68983E3D-3AC8-4B20-8338-F372835B7DB4}'" delete2⤵PID:2584
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68983E3D-3AC8-4B20-8338-F372835B7DB4}'" delete3⤵PID:1820
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FB19CD29-987A-4316-B729-A682ED3D39EE}'" delete2⤵PID:1532
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FB19CD29-987A-4316-B729-A682ED3D39EE}'" delete3⤵PID:1208
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 5242⤵
- Program crash
PID:2984
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d030c401512051cf275eb9d2b61f327e
SHA1eaf4022b5b6cd27b9e4a833d4863a3de6f65b819
SHA2567d6b2b2e67b72d46d10f8dbf0233bd3fa94ac11d839148e305d0190268ca6edb
SHA512e4d6864c785da9d703cc298b31f94887b914950fdb2ed635232e35baa6c4d8674fe8d327c1cde2808cbceb922136fcfe46d6591d6988125a09f414c2ec07df9d