conti | 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
Size

514KB
MD5

e16d9fea42a12e877198f687ee023e63
SHA1

5e84f5034c4372b8674eb4099da75c398c904955
SHA256

56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3
SHA512

2c9894f9abf9c3e7d544b6112510a689119fc0f118f614d86d868c1238fe696484d43e0a0a638c1f2a0c4d8b1a21fe524ffe2df6e6e06e6d7c206b69f57c7322
SSDEEP

3072:8vOXfbBI4++rye6iLfv7FizEPB5Oe4UKXqlc8Lm87wgZPzOmem0:nXzin6jwUKXSL/hLOH

Score

10^/10

conti credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- fqAM1Wjx6ZFKZezjt1CnsVfuNcsFUvsiwLgufIXADXkqyWAWww27zBekvcfCaTzh ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Renames multiple (7922) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00693_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Newsprint.eftx	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\THMBNAIL.PNG	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrome.7z	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files (x86)\Common Files\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382947.JPG	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287643.JPG	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_09.MID	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT.XML	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237228.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03257_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099198.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02578_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1A.BDR	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.XML	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15134_.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0088542.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\InitializeBlock.ps1	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00965_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00373_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\STUBBY2.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\LightSpirit.css	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18199_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18244_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00402_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.UK.XML	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	1316	vssvc.exe
Token: SeRestorePrivilege	1316	vssvc.exe
Token: SeAuditPrivilege	1316	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2760	WMIC.exe
Token: SeSecurityPrivilege	2760	WMIC.exe
Token: SeTakeOwnershipPrivilege	2760	WMIC.exe
Token: SeLoadDriverPrivilege	2760	WMIC.exe
Token: SeSystemProfilePrivilege	2760	WMIC.exe
Token: SeSystemtimePrivilege	2760	WMIC.exe
Token: SeProfSingleProcessPrivilege	2760	WMIC.exe
Token: SeIncBasePriorityPrivilege	2760	WMIC.exe
Token: SeCreatePagefilePrivilege	2760	WMIC.exe
Token: SeBackupPrivilege	2760	WMIC.exe
Token: SeRestorePrivilege	2760	WMIC.exe
Token: SeShutdownPrivilege	2760	WMIC.exe
Token: SeDebugPrivilege	2760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2760	WMIC.exe
Token: SeRemoteShutdownPrivilege	2760	WMIC.exe
Token: SeUndockPrivilege	2760	WMIC.exe
Token: SeManageVolumePrivilege	2760	WMIC.exe
Token: 33	2760	WMIC.exe
Token: 34	2760	WMIC.exe
Token: 35	2760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2760	WMIC.exe
Token: SeSecurityPrivilege	2760	WMIC.exe
Token: SeTakeOwnershipPrivilege	2760	WMIC.exe
Token: SeLoadDriverPrivilege	2760	WMIC.exe
Token: SeSystemProfilePrivilege	2760	WMIC.exe
Token: SeSystemtimePrivilege	2760	WMIC.exe
Token: SeProfSingleProcessPrivilege	2760	WMIC.exe
Token: SeIncBasePriorityPrivilege	2760	WMIC.exe
Token: SeCreatePagefilePrivilege	2760	WMIC.exe
Token: SeBackupPrivilege	2760	WMIC.exe
Token: SeRestorePrivilege	2760	WMIC.exe
Token: SeShutdownPrivilege	2760	WMIC.exe
Token: SeDebugPrivilege	2760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2760	WMIC.exe
Token: SeRemoteShutdownPrivilege	2760	WMIC.exe
Token: SeUndockPrivilege	2760	WMIC.exe
Token: SeManageVolumePrivilege	2760	WMIC.exe
Token: 33	2760	WMIC.exe
Token: 34	2760	WMIC.exe
Token: 35	2760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2924	WMIC.exe
Token: SeSecurityPrivilege	2924	WMIC.exe
Token: SeTakeOwnershipPrivilege	2924	WMIC.exe
Token: SeLoadDriverPrivilege	2924	WMIC.exe
Token: SeSystemProfilePrivilege	2924	WMIC.exe
Token: SeSystemtimePrivilege	2924	WMIC.exe
Token: SeProfSingleProcessPrivilege	2924	WMIC.exe
Token: SeIncBasePriorityPrivilege	2924	WMIC.exe
Token: SeCreatePagefilePrivilege	2924	WMIC.exe
Token: SeBackupPrivilege	2924	WMIC.exe
Token: SeRestorePrivilege	2924	WMIC.exe
Token: SeShutdownPrivilege	2924	WMIC.exe
Token: SeDebugPrivilege	2924	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2924	WMIC.exe
Token: SeRemoteShutdownPrivilege	2924	WMIC.exe
Token: SeUndockPrivilege	2924	WMIC.exe
Token: SeManageVolumePrivilege	2924	WMIC.exe
Token: 33	2924	WMIC.exe
Token: 34	2924	WMIC.exe
Token: 35	2924	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2924	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2784	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 3032 wrote to memory of 2784	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 3032 wrote to memory of 2784	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 3032 wrote to memory of 2784	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 2784 wrote to memory of 2760	2784	cmd.exe	35
PID 2784 wrote to memory of 2760	2784	cmd.exe	35
PID 2784 wrote to memory of 2760	2784	cmd.exe	35
PID 3032 wrote to memory of 2664	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 3032 wrote to memory of 2664	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 3032 wrote to memory of 2664	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 3032 wrote to memory of 2664	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 2664 wrote to memory of 2924	2664	cmd.exe	38
PID 2664 wrote to memory of 2924	2664	cmd.exe	38
PID 2664 wrote to memory of 2924	2664	cmd.exe	38
PID 3032 wrote to memory of 2764	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 3032 wrote to memory of 2764	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 3032 wrote to memory of 2764	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 3032 wrote to memory of 2764	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 2764 wrote to memory of 2672	2764	cmd.exe	41
PID 2764 wrote to memory of 2672	2764	cmd.exe	41
PID 2764 wrote to memory of 2672	2764	cmd.exe	41
PID 3032 wrote to memory of 2640	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 3032 wrote to memory of 2640	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 3032 wrote to memory of 2640	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 3032 wrote to memory of 2640	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 2640 wrote to memory of 2692	2640	cmd.exe	44
PID 2640 wrote to memory of 2692	2640	cmd.exe	44
PID 2640 wrote to memory of 2692	2640	cmd.exe	44
PID 3032 wrote to memory of 2248	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 3032 wrote to memory of 2248	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 3032 wrote to memory of 2248	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 3032 wrote to memory of 2248	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 2248 wrote to memory of 2452	2248	cmd.exe	47
PID 2248 wrote to memory of 2452	2248	cmd.exe	47
PID 2248 wrote to memory of 2452	2248	cmd.exe	47
PID 3032 wrote to memory of 844	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 3032 wrote to memory of 844	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 3032 wrote to memory of 844	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 3032 wrote to memory of 844	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 844 wrote to memory of 1700	844	cmd.exe	50
PID 844 wrote to memory of 1700	844	cmd.exe	50
PID 844 wrote to memory of 1700	844	cmd.exe	50
PID 3032 wrote to memory of 2616	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 3032 wrote to memory of 2616	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 3032 wrote to memory of 2616	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 3032 wrote to memory of 2616	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 2616 wrote to memory of 2368	2616	cmd.exe	53
PID 2616 wrote to memory of 2368	2616	cmd.exe	53
PID 2616 wrote to memory of 2368	2616	cmd.exe	53
PID 3032 wrote to memory of 1252	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 3032 wrote to memory of 1252	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 3032 wrote to memory of 1252	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 3032 wrote to memory of 1252	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 1252 wrote to memory of 1240	1252	cmd.exe	56
PID 1252 wrote to memory of 1240	1252	cmd.exe	56
PID 1252 wrote to memory of 1240	1252	cmd.exe	56
PID 3032 wrote to memory of 888	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 3032 wrote to memory of 888	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 3032 wrote to memory of 888	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 3032 wrote to memory of 888	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 888 wrote to memory of 1104	888	cmd.exe	59
PID 888 wrote to memory of 1104	888	cmd.exe	59
PID 888 wrote to memory of 1104	888	cmd.exe	59
PID 3032 wrote to memory of 328	3032	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	60

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
"C:\Users\Admin\AppData\Local\Temp\56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4A36D91E-2209-4D44-A858-B62FED425EBF}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4A36D91E-2209-4D44-A858-B62FED425EBF}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{78764994-1C6C-4CE6-9624-8E9AEC0D68BE}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{78764994-1C6C-4CE6-9624-8E9AEC0D68BE}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6B87DB47-D103-40E9-9B9F-7C20297A7F06}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6B87DB47-D103-40E9-9B9F-7C20297A7F06}'" delete
    3⤵
    PID:2672
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{738C1F1E-0D94-4BFE-8A62-6023CB3C2C78}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{738C1F1E-0D94-4BFE-8A62-6023CB3C2C78}'" delete
    3⤵
    PID:2692
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0C17BA65-6CDE-4721-946B-6D89E2600CD7}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0C17BA65-6CDE-4721-946B-6D89E2600CD7}'" delete
    3⤵
    PID:2452
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{176E9F4A-6F7B-4A9F-B2CC-2B7F01EB3F29}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{176E9F4A-6F7B-4A9F-B2CC-2B7F01EB3F29}'" delete
    3⤵
    PID:1700
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A65E4F4-63FF-44F5-85A9-A98154C5FC20}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A65E4F4-63FF-44F5-85A9-A98154C5FC20}'" delete
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0311638A-6341-4D7C-A545-F12FDE5065FC}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0311638A-6341-4D7C-A545-F12FDE5065FC}'" delete
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEF8B666-689B-4298-812B-B0CBF0F09CAF}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CEF8B666-689B-4298-812B-B0CBF0F09CAF}'" delete
    3⤵
    PID:1104
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{70C8360E-DCE9-4D96-A75A-5C4DD5B1D672}'" delete
  2⤵
  PID:328
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{70C8360E-DCE9-4D96-A75A-5C4DD5B1D672}'" delete
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B1376211-252F-4B53-B1EC-1488157D10CE}'" delete
  2⤵
  PID:1280
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B1376211-252F-4B53-B1EC-1488157D10CE}'" delete
    3⤵
    PID:2956
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6866BCD9-4F9A-49E6-996B-E45E1F58FB7F}'" delete
  2⤵
  PID:3064
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6866BCD9-4F9A-49E6-996B-E45E1F58FB7F}'" delete
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ECA7F184-0012-4F52-A79A-E05660957F96}'" delete
  2⤵
  PID:1780
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{ECA7F184-0012-4F52-A79A-E05660957F96}'" delete
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{584AA044-14F8-49A7-9F95-528AF801DDDC}'" delete
  2⤵
  PID:1340
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{584AA044-14F8-49A7-9F95-528AF801DDDC}'" delete
    3⤵
    PID:3016
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B469C8CC-AD90-432E-A61D-17AA2DDDCD6E}'" delete
  2⤵
  PID:712
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B469C8CC-AD90-432E-A61D-17AA2DDDCD6E}'" delete
    3⤵
    PID:2352
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A39938E1-E4DB-42E0-9092-177D98313B68}'" delete
  2⤵
  PID:1800
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A39938E1-E4DB-42E0-9092-177D98313B68}'" delete
    3⤵
    PID:1088
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97328781-6A36-4939-8247-D5835A1A7EE1}'" delete
  2⤵
  PID:2080
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{97328781-6A36-4939-8247-D5835A1A7EE1}'" delete
    3⤵
    PID:2608
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{032E701B-74EB-401C-9694-B72BF17D31D6}'" delete
  2⤵
  PID:2380
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{032E701B-74EB-401C-9694-B72BF17D31D6}'" delete
    3⤵
    PID:1824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
ac912958d8ddded9bb3117498e76ac41

SHA1
a818e44237b79ef828026c6530465a6ff6a17fd5

SHA256
da04404dcf44a4f0078819d3dfa9261e52a50d29ed379a75a6bd160e7bde02b2

SHA512
fb64251c4cf63f9df40b1738613fa13eddcc06e9d86246215fd38281d1b2e137308a26f9853f3f80edb4f5d01ccf9dc647bf7c7895527806b8cc705eb6e3ef0e

Download Submit