Malware Analysis Report

2024-10-16 03:20

Sample ID 240908-t9dljawgpp
Target da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a
SHA256 da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a
Tags
conti discovery ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a

Threat Level: Known bad

The file da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a was found to be: Known bad.

Malicious Activity Summary

conti discovery ransomware

Conti Ransomware

Renames multiple (70) files with added filename extension

Drops desktop.ini file(s)

Drops file in Program Files directory

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-08 16:45

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-08 16:45

Reported

2024-09-08 16:47

Platform

win7-20240903-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe"

Signatures

Conti Ransomware

ransomware conti

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\ResolveUninstall.mpv2 C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Internet Explorer\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\defaultagent.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\JoinConvert.m4v C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\StepStart.cr2 C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\Accessible.tlb C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\RequestDismount.mp4 C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\UseTrace.lock C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\License.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\Eurosti.TTF C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\SecretST.TTF C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\omni.ja C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\OutConfirm.xps C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ie9props.propdesc C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files (x86)\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\7zCon.sfx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\install.log C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\InitializeSkip.DVR C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Microsoft Office\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Mozilla Firefox\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\descript.ion C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\offset.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\RepairMount.mpe C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Common Files\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Java\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\DVD Maker\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\directshowtap.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Google\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\ApproveProtect.wax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\locale.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\ImportNew.dib C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Microsoft Games\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\application.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\defaultagent_localized.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\bod_r.TTF C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\fieldswitch.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3036 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2832 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2832 wrote to memory of 3000 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2316 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2316 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2316 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2896 wrote to memory of 1608 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2896 wrote to memory of 1608 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2896 wrote to memory of 1608 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2836 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2836 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2836 wrote to memory of 2588 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2748 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2748 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2748 wrote to memory of 1676 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2620 wrote to memory of 1560 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2620 wrote to memory of 1560 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2620 wrote to memory of 1560 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2812 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2812 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2812 wrote to memory of 2808 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 2076 wrote to memory of 2780 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2076 wrote to memory of 2780 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 2076 wrote to memory of 2780 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 3036 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe
PID 400 wrote to memory of 1660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 400 wrote to memory of 1660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 400 wrote to memory of 1660 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\wbem\WMIC.exe
PID 3036 wrote to memory of 1644 N/A C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe C:\Windows\system32\cmd.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe

"C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6BFCA4DD-F833-46C4-8C7A-34E95C2BA98D}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6BFCA4DD-F833-46C4-8C7A-34E95C2BA98D}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4E377BB5-7946-4CC9-B06C-A324542D9B33}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4E377BB5-7946-4CC9-B06C-A324542D9B33}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F41F126A-5EA4-4E10-877E-BFA9AE351D79}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F41F126A-5EA4-4E10-877E-BFA9AE351D79}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{13A7411F-E079-4EB9-B759-910BB841EC6D}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{13A7411F-E079-4EB9-B759-910BB841EC6D}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{608F4BCA-54A0-49F0-B303-80AC1CBD1CD4}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{608F4BCA-54A0-49F0-B303-80AC1CBD1CD4}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7A697E7-CA15-4B5B-9FDA-1DCF0DACE7C8}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7A697E7-CA15-4B5B-9FDA-1DCF0DACE7C8}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{032B90A4-C853-447C-A88F-A616A1A16CEF}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{032B90A4-C853-447C-A88F-A616A1A16CEF}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{61F1A0FC-3C8B-4300-9FF3-C45246E1E778}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{61F1A0FC-3C8B-4300-9FF3-C45246E1E778}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B85D3269-615C-49B2-B074-DFBE05B579B5}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B85D3269-615C-49B2-B074-DFBE05B579B5}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E9BC02D9-FA78-421F-B720-4BBFB960E0DD}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E9BC02D9-FA78-421F-B720-4BBFB960E0DD}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C73DB226-6809-4751-ACCA-A4430E07C2D2}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C73DB226-6809-4751-ACCA-A4430E07C2D2}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B655D79-AAB3-4069-958C-6DF22ABF6510}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B655D79-AAB3-4069-958C-6DF22ABF6510}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E1161CFE-6437-43A9-BBA0-7936376D6009}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E1161CFE-6437-43A9-BBA0-7936376D6009}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{748CC753-6941-4C85-9EC1-B37FB6C910A9}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{748CC753-6941-4C85-9EC1-B37FB6C910A9}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A84AFF1A-D5B8-4CEE-B0D4-72553726ACAB}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A84AFF1A-D5B8-4CEE-B0D4-72553726ACAB}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{793EE654-4AF1-454A-B02F-806B14DA0FF0}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{793EE654-4AF1-454A-B02F-806B14DA0FF0}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{77D12B2A-E418-4CAF-8BA1-6BD69F34D1A0}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{77D12B2A-E418-4CAF-8BA1-6BD69F34D1A0}'" delete

C:\Windows\system32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2677F393-95CA-43BD-A668-B8F93CCAAB49}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2677F393-95CA-43BD-A668-B8F93CCAAB49}'" delete

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1748

Network

Country Destination Domain Proto
N/A 10.127.0.0:445 tcp
N/A 10.127.0.1:445 tcp
N/A 10.127.0.2:445 tcp
N/A 10.127.0.3:445 tcp
N/A 10.127.0.4:445 tcp
N/A 10.127.0.5:445 tcp
N/A 10.127.0.6:445 tcp
N/A 10.127.0.7:445 tcp
N/A 10.127.0.8:445 tcp
N/A 10.127.0.9:445 tcp
N/A 10.127.0.10:445 tcp
N/A 10.127.0.11:445 tcp
N/A 10.127.0.12:445 tcp
N/A 10.127.0.13:445 tcp
N/A 10.127.0.14:445 tcp
N/A 10.127.0.15:445 tcp
N/A 10.127.0.16:445 tcp
N/A 10.127.0.17:445 tcp
N/A 10.127.0.18:445 tcp
N/A 10.127.0.19:445 tcp
N/A 10.127.0.20:445 tcp
N/A 10.127.0.21:445 tcp
N/A 10.127.0.22:445 tcp
N/A 10.127.0.23:445 tcp
N/A 10.127.0.24:445 tcp
N/A 10.127.0.25:445 tcp
N/A 10.127.0.26:445 tcp
N/A 10.127.0.27:445 tcp
N/A 10.127.0.28:445 tcp
N/A 10.127.0.29:445 tcp
N/A 10.127.0.30:445 tcp
N/A 10.127.0.31:445 tcp
N/A 10.127.0.32:445 tcp
N/A 10.127.0.33:445 tcp
N/A 10.127.0.34:445 tcp
N/A 10.127.0.35:445 tcp
N/A 10.127.0.36:445 tcp
N/A 10.127.0.37:445 tcp
N/A 10.127.0.38:445 tcp
N/A 10.127.0.39:445 tcp
N/A 10.127.0.40:445 tcp
N/A 10.127.0.41:445 tcp
N/A 10.127.0.42:445 tcp
N/A 10.127.0.43:445 tcp
N/A 10.127.0.44:445 tcp
N/A 10.127.0.45:445 tcp
N/A 10.127.0.46:445 tcp
N/A 10.127.0.47:445 tcp
N/A 10.127.0.48:445 tcp
N/A 10.127.0.49:445 tcp
N/A 10.127.0.50:445 tcp
N/A 10.127.0.51:445 tcp
N/A 10.127.0.52:445 tcp
N/A 10.127.0.53:445 tcp
N/A 10.127.0.54:445 tcp
N/A 10.127.0.55:445 tcp
N/A 10.127.0.56:445 tcp
N/A 10.127.0.57:445 tcp
N/A 10.127.0.58:445 tcp
N/A 10.127.0.59:445 tcp
N/A 10.127.0.60:445 tcp
N/A 10.127.0.61:445 tcp
N/A 10.127.0.62:445 tcp
N/A 10.127.0.63:445 tcp
N/A 10.127.0.64:445 tcp
N/A 10.127.0.65:445 tcp
N/A 10.127.0.66:445 tcp
N/A 10.127.0.67:445 tcp
N/A 10.127.0.68:445 tcp
N/A 10.127.0.69:445 tcp
N/A 10.127.0.70:445 tcp
N/A 10.127.0.71:445 tcp
N/A 10.127.0.72:445 tcp
N/A 10.127.0.73:445 tcp
N/A 10.127.0.74:445 tcp
N/A 10.127.0.75:445 tcp
N/A 10.127.0.76:445 tcp
N/A 10.127.0.77:445 tcp
N/A 10.127.0.78:445 tcp
N/A 10.127.0.79:445 tcp
N/A 10.127.0.80:445 tcp
N/A 10.127.0.81:445 tcp
N/A 10.127.0.82:445 tcp
N/A 10.127.0.83:445 tcp
N/A 10.127.0.84:445 tcp
N/A 10.127.0.85:445 tcp
N/A 10.127.0.86:445 tcp
N/A 10.127.0.87:445 tcp
N/A 10.127.0.88:445 tcp
N/A 10.127.0.89:445 tcp
N/A 10.127.0.90:445 tcp
N/A 10.127.0.91:445 tcp
N/A 10.127.0.92:445 tcp
N/A 10.127.0.93:445 tcp
N/A 10.127.0.94:445 tcp
N/A 10.127.0.95:445 tcp
N/A 10.127.0.96:445 tcp
N/A 10.127.0.97:445 tcp
N/A 10.127.0.98:445 tcp
N/A 10.127.0.99:445 tcp
N/A 10.127.0.100:445 tcp
N/A 10.127.0.101:445 tcp
N/A 10.127.0.102:445 tcp
N/A 10.127.0.103:445 tcp
N/A 10.127.0.104:445 tcp
N/A 10.127.0.105:445 tcp
N/A 10.127.0.106:445 tcp
N/A 10.127.0.107:445 tcp
N/A 10.127.0.108:445 tcp
N/A 10.127.0.109:445 tcp
N/A 10.127.0.110:445 tcp
N/A 10.127.0.111:445 tcp
N/A 10.127.0.112:445 tcp
N/A 10.127.0.113:445 tcp
N/A 10.127.0.114:445 tcp
N/A 10.127.0.115:445 tcp
N/A 10.127.0.116:445 tcp
N/A 10.127.0.117:445 tcp
N/A 10.127.0.118:445 tcp
N/A 10.127.0.119:445 tcp
N/A 10.127.0.120:445 tcp
N/A 10.127.0.121:445 tcp
N/A 10.127.0.122:445 tcp
N/A 10.127.0.123:445 tcp
N/A 10.127.0.124:445 tcp
N/A 10.127.0.125:445 tcp
N/A 10.127.0.126:445 tcp
N/A 10.127.0.127:445 tcp
N/A 10.127.0.128:445 tcp
N/A 10.127.0.129:445 tcp
N/A 10.127.0.130:445 tcp
N/A 10.127.0.131:445 tcp
N/A 10.127.0.132:445 tcp
N/A 10.127.0.133:445 tcp
N/A 10.127.0.134:445 tcp
N/A 10.127.0.135:445 tcp
N/A 10.127.0.136:445 tcp
N/A 10.127.0.137:445 tcp
N/A 10.127.0.138:445 tcp
N/A 10.127.0.139:445 tcp
N/A 10.127.0.140:445 tcp
N/A 10.127.0.141:445 tcp
N/A 10.127.0.142:445 tcp
N/A 10.127.0.143:445 tcp
N/A 10.127.0.144:445 tcp
N/A 10.127.0.145:445 tcp
N/A 10.127.0.146:445 tcp
N/A 10.127.0.147:445 tcp
N/A 10.127.0.148:445 tcp
N/A 10.127.0.149:445 tcp
N/A 10.127.0.150:445 tcp
N/A 10.127.0.151:445 tcp
N/A 10.127.0.152:445 tcp
N/A 10.127.0.153:445 tcp
N/A 10.127.0.154:445 tcp
N/A 10.127.0.155:445 tcp
N/A 10.127.0.156:445 tcp
N/A 10.127.0.157:445 tcp
N/A 10.127.0.158:445 tcp
N/A 10.127.0.159:445 tcp
N/A 10.127.0.160:445 tcp
N/A 10.127.0.161:445 tcp
N/A 10.127.0.162:445 tcp
N/A 10.127.0.163:445 tcp
N/A 10.127.0.164:445 tcp
N/A 10.127.0.165:445 tcp
N/A 10.127.0.166:445 tcp
N/A 10.127.0.167:445 tcp
N/A 10.127.0.168:445 tcp
N/A 10.127.0.169:445 tcp
N/A 10.127.0.170:445 tcp
N/A 10.127.0.171:445 tcp
N/A 10.127.0.172:445 tcp
N/A 10.127.0.173:445 tcp
N/A 10.127.0.174:445 tcp
N/A 10.127.0.175:445 tcp
N/A 10.127.0.176:445 tcp
N/A 10.127.0.177:445 tcp
N/A 10.127.0.178:445 tcp
N/A 10.127.0.179:445 tcp
N/A 10.127.0.180:445 tcp
N/A 10.127.0.181:445 tcp
N/A 10.127.0.182:445 tcp
N/A 10.127.0.183:445 tcp
N/A 10.127.0.184:445 tcp
N/A 10.127.0.185:445 tcp
N/A 10.127.0.186:445 tcp
N/A 10.127.0.187:445 tcp
N/A 10.127.0.188:445 tcp
N/A 10.127.0.189:445 tcp
N/A 10.127.0.190:445 tcp
N/A 10.127.0.191:445 tcp
N/A 10.127.0.192:445 tcp
N/A 10.127.0.193:445 tcp
N/A 10.127.0.194:445 tcp
N/A 10.127.0.195:445 tcp
N/A 10.127.0.196:445 tcp
N/A 10.127.0.197:445 tcp
N/A 10.127.0.198:445 tcp
N/A 10.127.0.199:445 tcp
N/A 10.127.0.200:445 tcp
N/A 10.127.0.201:445 tcp
N/A 10.127.0.202:445 tcp
N/A 10.127.0.203:445 tcp
N/A 10.127.0.204:445 tcp
N/A 10.127.0.205:445 tcp
N/A 10.127.0.206:445 tcp
N/A 10.127.0.207:445 tcp
N/A 10.127.0.208:445 tcp
N/A 10.127.0.209:445 tcp
N/A 10.127.0.210:445 tcp
N/A 10.127.0.211:445 tcp
N/A 10.127.0.212:445 tcp
N/A 10.127.0.213:445 tcp
N/A 10.127.0.214:445 tcp
N/A 10.127.0.215:445 tcp
N/A 10.127.0.216:445 tcp
N/A 10.127.0.217:445 tcp
N/A 10.127.0.218:445 tcp
N/A 10.127.0.219:445 tcp
N/A 10.127.0.220:445 tcp
N/A 10.127.0.221:445 tcp
N/A 10.127.0.222:445 tcp
N/A 10.127.0.223:445 tcp
N/A 10.127.0.224:445 tcp
N/A 10.127.0.225:445 tcp
N/A 10.127.0.226:445 tcp
N/A 10.127.0.227:445 tcp
N/A 10.127.0.228:445 tcp
N/A 10.127.0.229:445 tcp
N/A 10.127.0.230:445 tcp
N/A 10.127.0.231:445 tcp
N/A 10.127.0.232:445 tcp
N/A 10.127.0.233:445 tcp
N/A 10.127.0.234:445 tcp
N/A 10.127.0.235:445 tcp
N/A 10.127.0.236:445 tcp
N/A 10.127.0.237:445 tcp
N/A 10.127.0.238:445 tcp
N/A 10.127.0.239:445 tcp
N/A 10.127.0.240:445 tcp
N/A 10.127.0.241:445 tcp
N/A 10.127.0.242:445 tcp
N/A 10.127.0.243:445 tcp
N/A 10.127.0.244:445 tcp
N/A 10.127.0.245:445 tcp
N/A 10.127.0.246:445 tcp
N/A 10.127.0.247:445 tcp
N/A 10.127.0.248:445 tcp
N/A 10.127.0.249:445 tcp
N/A 10.127.0.250:445 tcp
N/A 10.127.0.251:445 tcp
N/A 10.127.0.252:445 tcp
N/A 10.127.0.253:445 tcp
N/A 10.127.0.254:445 tcp

Files

C:\Program Files (x86)\readme.txt

MD5 b09421db407d07cecd7aaa502f3d3285
SHA1 8eabdcbb000e14771f6fefac998eb561195dc940
SHA256 95d94695f3c26ca2000a047d2d272a4552d452c8b3e6e3371ac427b3a43db30a
SHA512 455e6a0494a640b4079e3b635e6d4311a55af3110f41de2c0e14c6e909d24d9839f123155a7b712012b6cc60838605857565ac7a6571dcef935a8eca7604460b

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-08 16:45

Reported

2024-09-08 16:47

Platform

win10v2004-20240802-en

Max time kernel

94s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe"

Signatures

Conti Ransomware

ransomware conti

Renames multiple (70) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\SendConfirm.midi C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Common Files\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Crashpad\settings.dat C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\install.log C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\omni.ja C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\CompleteUnpublish.pps C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\RedoOpen.php C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files (x86)\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Crashpad\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\dotnet\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\BackupApprove.mpg C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\InitializeStart.mov C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Microsoft Office\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Mozilla Firefox\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\ExpandApprove.potx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\WaitEdit.mpp C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\RestoreCompare.mpeg2 C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DisconnectOptimize.asx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\ExitSplit.xlt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\dotnet\ThirdPartyNotices.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\EditComplete.DVR-MS C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\PublishSelect.reg C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Microsoft Office\AppXManifest.xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\LimitResolve.js C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\SwitchRename.ppsx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Microsoft Office\FileSystemMetadata.xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Microsoft Office\ThinAppXManifest.xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\installation_telemetry.json C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\descript.ion C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Google\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Crashpad\metadata C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\RegisterConvertTo.docm C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\JoinConvertTo.tiff C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\dotnet\LICENSE.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\InvokeRestore.docx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\EditConnect.nfo C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\HideExport.ram C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\PushUnlock.ppsx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\RenameDebug.pcx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DisableWatch.ps1xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\defaultagent.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\dependentlibs.list C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\DenyUnblock.html C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\ResetConvertTo.clr C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\InitializeMeasure.png C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Microsoft Office 15\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\locale.ini C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\ExportConnect.xml C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\7-Zip\7zCon.sfx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\StartRedo.cfg C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File created C:\Program Files\Java\readme.txt C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\ClearReceive.otf C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\OpenRevoke.pdf C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\RestartEnable.mov C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A
File opened for modification C:\Program Files\SearchGrant.xlsx C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\wbem\WMIC.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe

"C:\Users\Admin\AppData\Local\Temp\da05567a6e292ab184169166ca230edaf3e8e9bc5effcb649901f589105b1b3a.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SYSTEM32\cmd.exe

cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BA175DB9-2CF3-48F1-A672-0E52F9673828}'" delete

C:\Windows\System32\wbem\WMIC.exe

C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BA175DB9-2CF3-48F1-A672-0E52F9673828}'" delete

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 396 -ip 396

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 2188

Network

Country Destination Domain Proto
N/A 10.127.0.1:445 tcp
N/A 10.127.0.0:445 tcp
N/A 10.127.0.2:445 tcp
N/A 10.127.0.3:445 tcp
N/A 10.127.0.4:445 tcp
N/A 10.127.0.5:445 tcp
N/A 10.127.0.6:445 tcp
N/A 10.127.0.7:445 tcp
N/A 10.127.0.8:445 tcp
N/A 10.127.0.9:445 tcp
N/A 10.127.0.10:445 tcp
N/A 10.127.0.11:445 tcp
N/A 10.127.0.12:445 tcp
N/A 10.127.0.13:445 tcp
N/A 10.127.0.14:445 tcp
N/A 10.127.0.15:445 tcp
N/A 10.127.0.16:445 tcp
N/A 10.127.0.17:445 tcp
N/A 10.127.0.18:445 tcp
N/A 10.127.0.19:445 tcp
N/A 10.127.0.20:445 tcp
N/A 10.127.0.21:445 tcp
N/A 10.127.0.22:445 tcp
N/A 10.127.0.23:445 tcp
N/A 10.127.0.24:445 tcp
N/A 10.127.0.25:445 tcp
N/A 10.127.0.26:445 tcp
N/A 10.127.0.27:445 tcp
N/A 10.127.0.28:445 tcp
N/A 10.127.0.29:445 tcp
N/A 10.127.0.30:445 tcp
N/A 10.127.0.31:445 tcp
N/A 10.127.0.32:445 tcp
N/A 10.127.0.33:445 tcp
N/A 10.127.0.34:445 tcp
N/A 10.127.0.35:445 tcp
N/A 10.127.0.36:445 tcp
N/A 10.127.0.37:445 tcp
N/A 10.127.0.38:445 tcp
N/A 10.127.0.39:445 tcp
N/A 10.127.0.40:445 tcp
N/A 10.127.0.41:445 tcp
N/A 10.127.0.42:445 tcp
N/A 10.127.0.43:445 tcp
N/A 10.127.0.44:445 tcp
N/A 10.127.0.45:445 tcp
N/A 10.127.0.46:445 tcp
N/A 10.127.0.47:445 tcp
N/A 10.127.0.48:445 tcp
N/A 10.127.0.49:445 tcp
N/A 10.127.0.50:445 tcp
N/A 10.127.0.51:445 tcp
N/A 10.127.0.52:445 tcp
N/A 10.127.0.53:445 tcp
N/A 10.127.0.54:445 tcp
N/A 10.127.0.55:445 tcp
N/A 10.127.0.56:445 tcp
N/A 10.127.0.57:445 tcp
N/A 10.127.0.58:445 tcp
N/A 10.127.0.59:445 tcp
N/A 10.127.0.60:445 tcp
N/A 10.127.0.61:445 tcp
N/A 10.127.0.62:445 tcp
N/A 10.127.0.63:445 tcp
N/A 10.127.0.64:445 tcp
N/A 10.127.0.65:445 tcp
N/A 10.127.0.66:445 tcp
N/A 10.127.0.67:445 tcp
N/A 10.127.0.68:445 tcp
N/A 10.127.0.69:445 tcp
N/A 10.127.0.70:445 tcp
N/A 10.127.0.71:445 tcp
N/A 10.127.0.72:445 tcp
N/A 10.127.0.73:445 tcp
N/A 10.127.0.74:445 tcp
N/A 10.127.0.75:445 tcp
N/A 10.127.0.76:445 tcp
N/A 10.127.0.77:445 tcp
N/A 10.127.0.78:445 tcp
N/A 10.127.0.79:445 tcp
N/A 10.127.0.80:445 tcp
N/A 10.127.0.81:445 tcp
N/A 10.127.0.82:445 tcp
N/A 10.127.0.83:445 tcp
N/A 10.127.0.84:445 tcp
N/A 10.127.0.85:445 tcp
N/A 10.127.0.86:445 tcp
N/A 10.127.0.87:445 tcp
N/A 10.127.0.88:445 tcp
N/A 10.127.0.89:445 tcp
N/A 10.127.0.90:445 tcp
N/A 10.127.0.91:445 tcp
N/A 10.127.0.92:445 tcp
N/A 10.127.0.93:445 tcp
N/A 10.127.0.94:445 tcp
N/A 10.127.0.95:445 tcp
N/A 10.127.0.96:445 tcp
N/A 10.127.0.97:445 tcp
N/A 10.127.0.98:445 tcp
N/A 10.127.0.99:445 tcp
N/A 10.127.0.100:445 tcp
N/A 10.127.0.101:445 tcp
N/A 10.127.0.102:445 tcp
N/A 10.127.0.103:445 tcp
N/A 10.127.0.104:445 tcp
N/A 10.127.0.105:445 tcp
N/A 10.127.0.106:445 tcp
N/A 10.127.0.107:445 tcp
N/A 10.127.0.108:445 tcp
N/A 10.127.0.109:445 tcp
N/A 10.127.0.110:445 tcp
N/A 10.127.0.111:445 tcp
N/A 10.127.0.112:445 tcp
N/A 10.127.0.113:445 tcp
N/A 10.127.0.114:445 tcp
N/A 10.127.0.115:445 tcp
N/A 10.127.0.116:445 tcp
N/A 10.127.0.117:445 tcp
N/A 10.127.0.118:445 tcp
N/A 10.127.0.119:445 tcp
N/A 10.127.0.120:445 tcp
N/A 10.127.0.121:445 tcp
N/A 10.127.0.122:445 tcp
N/A 10.127.0.123:445 tcp
N/A 10.127.0.124:445 tcp
N/A 10.127.0.125:445 tcp
N/A 10.127.0.126:445 tcp
N/A 10.127.0.127:445 tcp
N/A 10.127.0.128:445 tcp
N/A 10.127.0.129:445 tcp
N/A 10.127.0.130:445 tcp
N/A 10.127.0.131:445 tcp
N/A 10.127.0.132:445 tcp
N/A 10.127.0.133:445 tcp
N/A 10.127.0.134:445 tcp
N/A 10.127.0.135:445 tcp
N/A 10.127.0.136:445 tcp
N/A 10.127.0.137:445 tcp
N/A 10.127.0.138:445 tcp
N/A 10.127.0.139:445 tcp
N/A 10.127.0.140:445 tcp
N/A 10.127.0.141:445 tcp
N/A 10.127.0.142:445 tcp
N/A 10.127.0.143:445 tcp
N/A 10.127.0.144:445 tcp
N/A 10.127.0.145:445 tcp
N/A 10.127.0.146:445 tcp
N/A 10.127.0.147:445 tcp
N/A 10.127.0.148:445 tcp
N/A 10.127.0.149:445 tcp
N/A 10.127.0.150:445 tcp
N/A 10.127.0.151:445 tcp
N/A 10.127.0.152:445 tcp
N/A 10.127.0.153:445 tcp
N/A 10.127.0.154:445 tcp
N/A 10.127.0.155:445 tcp
N/A 10.127.0.156:445 tcp
N/A 10.127.0.157:445 tcp
N/A 10.127.0.158:445 tcp
N/A 10.127.0.159:445 tcp
N/A 10.127.0.160:445 tcp
N/A 10.127.0.161:445 tcp
N/A 10.127.0.162:445 tcp
N/A 10.127.0.163:445 tcp
N/A 10.127.0.164:445 tcp
N/A 10.127.0.165:445 tcp
N/A 10.127.0.166:445 tcp
N/A 10.127.0.167:445 tcp
N/A 10.127.0.168:445 tcp
N/A 10.127.0.169:445 tcp
N/A 10.127.0.170:445 tcp
N/A 10.127.0.171:445 tcp
N/A 10.127.0.172:445 tcp
N/A 10.127.0.173:445 tcp
N/A 10.127.0.174:445 tcp
N/A 10.127.0.175:445 tcp
N/A 10.127.0.176:445 tcp
N/A 10.127.0.177:445 tcp
N/A 10.127.0.178:445 tcp
N/A 10.127.0.179:445 tcp
N/A 10.127.0.180:445 tcp
N/A 10.127.0.181:445 tcp
N/A 10.127.0.182:445 tcp
N/A 10.127.0.183:445 tcp
N/A 10.127.0.184:445 tcp
N/A 10.127.0.185:445 tcp
N/A 10.127.0.186:445 tcp
N/A 10.127.0.187:445 tcp
N/A 10.127.0.188:445 tcp
N/A 10.127.0.189:445 tcp
N/A 10.127.0.190:445 tcp
N/A 10.127.0.191:445 tcp
N/A 10.127.0.192:445 tcp
N/A 10.127.0.193:445 tcp
N/A 10.127.0.194:445 tcp
N/A 10.127.0.195:445 tcp
N/A 10.127.0.196:445 tcp
N/A 10.127.0.197:445 tcp
N/A 10.127.0.198:445 tcp
N/A 10.127.0.199:445 tcp
N/A 10.127.0.200:445 tcp
N/A 10.127.0.201:445 tcp
N/A 10.127.0.202:445 tcp
N/A 10.127.0.203:445 tcp
N/A 10.127.0.204:445 tcp
N/A 10.127.0.205:445 tcp
N/A 10.127.0.206:445 tcp
N/A 10.127.0.207:445 tcp
N/A 10.127.0.208:445 tcp
N/A 10.127.0.209:445 tcp
N/A 10.127.0.210:445 tcp
N/A 10.127.0.211:445 tcp
N/A 10.127.0.212:445 tcp
N/A 10.127.0.213:445 tcp
N/A 10.127.0.214:445 tcp
N/A 10.127.0.215:445 tcp
N/A 10.127.0.216:445 tcp
N/A 10.127.0.217:445 tcp
N/A 10.127.0.218:445 tcp
N/A 10.127.0.219:445 tcp
N/A 10.127.0.220:445 tcp
N/A 10.127.0.221:445 tcp
N/A 10.127.0.222:445 tcp
N/A 10.127.0.223:445 tcp
N/A 10.127.0.224:445 tcp
N/A 10.127.0.225:445 tcp
N/A 10.127.0.226:445 tcp
N/A 10.127.0.227:445 tcp
N/A 10.127.0.228:445 tcp
N/A 10.127.0.229:445 tcp
N/A 10.127.0.230:445 tcp
N/A 10.127.0.231:445 tcp
N/A 10.127.0.232:445 tcp
N/A 10.127.0.233:445 tcp
N/A 10.127.0.234:445 tcp
N/A 10.127.0.235:445 tcp
N/A 10.127.0.236:445 tcp
N/A 10.127.0.237:445 tcp
N/A 10.127.0.238:445 tcp
N/A 10.127.0.239:445 tcp
N/A 10.127.0.240:445 tcp
N/A 10.127.0.241:445 tcp
N/A 10.127.0.242:445 tcp
N/A 10.127.0.243:445 tcp
N/A 10.127.0.244:445 tcp
N/A 10.127.0.245:445 tcp
N/A 10.127.0.246:445 tcp
N/A 10.127.0.247:445 tcp
N/A 10.127.0.248:445 tcp
N/A 10.127.0.249:445 tcp
N/A 10.127.0.250:445 tcp
N/A 10.127.0.251:445 tcp
N/A 10.127.0.252:445 tcp
N/A 10.127.0.253:445 tcp
N/A 10.127.0.254:445 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\ProgramData\readme.txt

MD5 b09421db407d07cecd7aaa502f3d3285
SHA1 8eabdcbb000e14771f6fefac998eb561195dc940
SHA256 95d94695f3c26ca2000a047d2d272a4552d452c8b3e6e3371ac427b3a43db30a
SHA512 455e6a0494a640b4079e3b635e6d4311a55af3110f41de2c0e14c6e909d24d9839f123155a7b712012b6cc60838605857565ac7a6571dcef935a8eca7604460b