conti | 75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
Size

514KB
MD5

3d8f8da9897e81121c83d0d17c560452
SHA1

9829e8264216726f69e731394c08354e74a3b1f8
SHA256

75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb
SHA512

de066843392b0fb410269142732885bb0e5f7cba8b78023d126d9ef14433451a8baa96b90091b9819d57a9e4cffd9ac44d733af46a4f70f5a0cc476f20293132
SSDEEP

3072:Qy3XfbBI4++rye6iLf2zKUAOe4UKXqlc8Lm87wgZPyzOmem0Oa9G8Y3:FXzin6raUKXSL/hIOH/

Score

10^/10

conti discovery ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- lWL5aqUDwBJQsqHmM6OkU1yOTGOiNHcCdTAyuj6A1xKUIz98qMCGpifNoPeYSXBA ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti

Drops file in Program Files directory 59 IoCs

Processes:

75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

description	ioc	process
File opened for modification	C:\Program Files\ResetPing.TTS	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\ClearConvertTo.asx	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\CompareSync.sql	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsource.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\UpdateBackup.htm	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\soniccolorconverter.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\Google\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\installation_telemetry.json	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\RevokeOpen.odt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\DVD Maker\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Internet Explorer\ie9props.propdesc	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\EditSubmit.xhtml	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\SearchInitialize.otf	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\Java\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\OutTrace.vst	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\GetUnpublish.aifc	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files (x86)\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\Common Files\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\bod_r.TTF	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\Internet Explorer\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\GrantMerge.M2TS	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\directshowtap.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\fieldswitch.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\Microsoft Games\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\install.log	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\FormatCheckpoint.css	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\audiodepthconverter.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\ConvertFromSync.mpg	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\CompressReceive.pps	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\Eurosti.TTF	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DebugSearch.emz	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\StartCompare.MOD	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\offset.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\Microsoft Office\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.cfg	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\JoinExpand.mp2	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\PushDisconnect.easmx	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\SearchSplit.wmv	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsink.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File created	C:\Program Files\Mozilla Firefox\readme.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\BlockSet.wmf	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\LimitMove.cr2	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\GroupRestart.wma	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\SelectSync.xlsm	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\DVD Maker\sonicsptransform.ax	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2616 2368 WerFault.exe 75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

pid	pid_target	process	target process
2616	2368	WerFault.exe	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

pid process

2368 75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

pid	process
2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	2520	vssvc.exe
Token: SeRestorePrivilege	2520	vssvc.exe
Token: SeAuditPrivilege	2520	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2768	WMIC.exe
Token: SeSecurityPrivilege	2768	WMIC.exe
Token: SeTakeOwnershipPrivilege	2768	WMIC.exe
Token: SeLoadDriverPrivilege	2768	WMIC.exe
Token: SeSystemProfilePrivilege	2768	WMIC.exe
Token: SeSystemtimePrivilege	2768	WMIC.exe
Token: SeProfSingleProcessPrivilege	2768	WMIC.exe
Token: SeIncBasePriorityPrivilege	2768	WMIC.exe
Token: SeCreatePagefilePrivilege	2768	WMIC.exe
Token: SeBackupPrivilege	2768	WMIC.exe
Token: SeRestorePrivilege	2768	WMIC.exe
Token: SeShutdownPrivilege	2768	WMIC.exe
Token: SeDebugPrivilege	2768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2768	WMIC.exe
Token: SeRemoteShutdownPrivilege	2768	WMIC.exe
Token: SeUndockPrivilege	2768	WMIC.exe
Token: SeManageVolumePrivilege	2768	WMIC.exe
Token: 33	2768	WMIC.exe
Token: 34	2768	WMIC.exe
Token: 35	2768	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2768	WMIC.exe
Token: SeSecurityPrivilege	2768	WMIC.exe
Token: SeTakeOwnershipPrivilege	2768	WMIC.exe
Token: SeLoadDriverPrivilege	2768	WMIC.exe
Token: SeSystemProfilePrivilege	2768	WMIC.exe
Token: SeSystemtimePrivilege	2768	WMIC.exe
Token: SeProfSingleProcessPrivilege	2768	WMIC.exe
Token: SeIncBasePriorityPrivilege	2768	WMIC.exe
Token: SeCreatePagefilePrivilege	2768	WMIC.exe
Token: SeBackupPrivilege	2768	WMIC.exe
Token: SeRestorePrivilege	2768	WMIC.exe
Token: SeShutdownPrivilege	2768	WMIC.exe
Token: SeDebugPrivilege	2768	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2768	WMIC.exe
Token: SeRemoteShutdownPrivilege	2768	WMIC.exe
Token: SeUndockPrivilege	2768	WMIC.exe
Token: SeManageVolumePrivilege	2768	WMIC.exe
Token: 33	2768	WMIC.exe
Token: 34	2768	WMIC.exe
Token: 35	2768	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2760	WMIC.exe
Token: SeSecurityPrivilege	2760	WMIC.exe
Token: SeTakeOwnershipPrivilege	2760	WMIC.exe
Token: SeLoadDriverPrivilege	2760	WMIC.exe
Token: SeSystemProfilePrivilege	2760	WMIC.exe
Token: SeSystemtimePrivilege	2760	WMIC.exe
Token: SeProfSingleProcessPrivilege	2760	WMIC.exe
Token: SeIncBasePriorityPrivilege	2760	WMIC.exe
Token: SeCreatePagefilePrivilege	2760	WMIC.exe
Token: SeBackupPrivilege	2760	WMIC.exe
Token: SeRestorePrivilege	2760	WMIC.exe
Token: SeShutdownPrivilege	2760	WMIC.exe
Token: SeDebugPrivilege	2760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2760	WMIC.exe
Token: SeRemoteShutdownPrivilege	2760	WMIC.exe
Token: SeUndockPrivilege	2760	WMIC.exe
Token: SeManageVolumePrivilege	2760	WMIC.exe
Token: 33	2760	WMIC.exe
Token: 34	2760	WMIC.exe
Token: 35	2760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2760	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2368 wrote to memory of 2728	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2728	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2728	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2728	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2728 wrote to memory of 2768	2728	cmd.exe	WMIC.exe
PID 2728 wrote to memory of 2768	2728	cmd.exe	WMIC.exe
PID 2728 wrote to memory of 2768	2728	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2848	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2848	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2848	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2848	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2848 wrote to memory of 2760	2848	cmd.exe	WMIC.exe
PID 2848 wrote to memory of 2760	2848	cmd.exe	WMIC.exe
PID 2848 wrote to memory of 2760	2848	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2884	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2884	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2884	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2884	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2884 wrote to memory of 2864	2884	cmd.exe	WMIC.exe
PID 2884 wrote to memory of 2864	2884	cmd.exe	WMIC.exe
PID 2884 wrote to memory of 2864	2884	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2972	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2972	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2972	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2972	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2972 wrote to memory of 2784	2972	cmd.exe	WMIC.exe
PID 2972 wrote to memory of 2784	2972	cmd.exe	WMIC.exe
PID 2972 wrote to memory of 2784	2972	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2612	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2612	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2612	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2612	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2612 wrote to memory of 2668	2612	cmd.exe	WMIC.exe
PID 2612 wrote to memory of 2668	2612	cmd.exe	WMIC.exe
PID 2612 wrote to memory of 2668	2612	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2000	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2000	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2000	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2000	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2000 wrote to memory of 2264	2000	cmd.exe	WMIC.exe
PID 2000 wrote to memory of 2264	2000	cmd.exe	WMIC.exe
PID 2000 wrote to memory of 2264	2000	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2372	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2372	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2372	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2372	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2372 wrote to memory of 1492	2372	cmd.exe	WMIC.exe
PID 2372 wrote to memory of 1492	2372	cmd.exe	WMIC.exe
PID 2372 wrote to memory of 1492	2372	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2812	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2812	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2812	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2812	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2812 wrote to memory of 1736	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 1736	2812	cmd.exe	WMIC.exe
PID 2812 wrote to memory of 1736	2812	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 2096	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2096	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2096	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2368 wrote to memory of 2096	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe
PID 2096 wrote to memory of 1540	2096	cmd.exe	WMIC.exe
PID 2096 wrote to memory of 1540	2096	cmd.exe	WMIC.exe
PID 2096 wrote to memory of 1540	2096	cmd.exe	WMIC.exe
PID 2368 wrote to memory of 1804	2368	75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe
"C:\Users\Admin\AppData\Local\Temp\75684493a91c2b71fc7446d4a949eac03d26e7fc68ed9a19e3b3374fe4806dfb.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2BD6FB29-189E-4F99-9F99-651A72FEBF02}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2BD6FB29-189E-4F99-9F99-651A72FEBF02}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D818798-4B47-458C-8916-CBECAE43B4FB}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D818798-4B47-458C-8916-CBECAE43B4FB}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1BB337A5-A97C-4E3B-A953-6F743F6A68A9}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1BB337A5-A97C-4E3B-A953-6F743F6A68A9}'" delete
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6477892D-EC9E-4CBF-B454-FA61DC46F5FA}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6477892D-EC9E-4CBF-B454-FA61DC46F5FA}'" delete
    3⤵
    PID:2784
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56351986-B650-4647-8784-B3B760645DA4}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56351986-B650-4647-8784-B3B760645DA4}'" delete
    3⤵
    PID:2668
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2265C065-B6B0-4775-9799-36B9FEE32622}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2265C065-B6B0-4775-9799-36B9FEE32622}'" delete
    3⤵
    PID:2264
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FABF953-9C39-45E5-BBE9-8EA6C9C47AFC}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FABF953-9C39-45E5-BBE9-8EA6C9C47AFC}'" delete
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8B936CD8-A865-4FAC-8D84-CBCB07B701E1}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8B936CD8-A865-4FAC-8D84-CBCB07B701E1}'" delete
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6309368E-BFB6-486E-98FD-95DB63CF8CCD}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6309368E-BFB6-486E-98FD-95DB63CF8CCD}'" delete
    3⤵
    PID:1540
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C86CD55D-C4A7-41EE-9996-50648480DCD1}'" delete
  2⤵
  PID:1804
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C86CD55D-C4A7-41EE-9996-50648480DCD1}'" delete
    3⤵
    PID:1528
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F1EC04A3-70A5-446C-82A7-F72478B1F67F}'" delete
  2⤵
  PID:316
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F1EC04A3-70A5-446C-82A7-F72478B1F67F}'" delete
    3⤵
    PID:2004
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D0EA2D8B-0324-4D6B-B67E-47501DE36B0D}'" delete
  2⤵
  PID:2944
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D0EA2D8B-0324-4D6B-B67E-47501DE36B0D}'" delete
    3⤵
    PID:2920
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF511B92-0D8F-4A7D-8D02-DBF4F564E117}'" delete
  2⤵
  PID:2356
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF511B92-0D8F-4A7D-8D02-DBF4F564E117}'" delete
    3⤵
    PID:820
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{49B72978-0008-434A-B917-90D3B1C2A77E}'" delete
  2⤵
  PID:2144
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{49B72978-0008-434A-B917-90D3B1C2A77E}'" delete
    3⤵
    PID:1888
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA9990C9-A884-4636-9E67-9D57557C520F}'" delete
  2⤵
  PID:1688
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA9990C9-A884-4636-9E67-9D57557C520F}'" delete
    3⤵
    PID:1516
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BDBC865F-CD95-469C-87CB-A93B7E42F6FC}'" delete
  2⤵
  PID:2960
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BDBC865F-CD95-469C-87CB-A93B7E42F6FC}'" delete
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F2239B57-C45C-479E-80DD-8AD930A4200B}'" delete
  2⤵
  PID:2460
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F2239B57-C45C-479E-80DD-8AD930A4200B}'" delete
    3⤵
    PID:688
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2ECE20AD-81EF-4472-98D5-76CDE183AA48}'" delete
  2⤵
  PID:1340
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2ECE20AD-81EF-4472-98D5-76CDE183AA48}'" delete
    3⤵
    PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 1592
  2⤵
  - Program crash
  PID:2616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
306b84b6dfba111b3e824d86804998f1

SHA1
7c1cb91fc2b13ca9b6e96407e12e9811a245eab1

SHA256
3d1d151274bffd401a292c2d6a9c165a757d60e9910e0a04b13ab2feb2655854

SHA512
a0313e4a392aeeb17271d007eea708d19e598525f9a78a6c2aa1fb4485ca7b54686c4c0f87b41606729f1d42ee4419f5e25e56aaeddb887fd5f7e57ed200ea0b

Download Submit