conti | d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 16:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
Size

515KB
MD5

3b99e833809115583f76a1d8637dcbaf
SHA1

e1b5e7a4486e63dad4bde2322f9d7725fbd2eb3b
SHA256

d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e
SHA512

aaaf4318ec34381f7cfa5d7908635082f7e4e7486649e9cafebfb1fb748028a7a18558ed51338f40f35daed86e5da39e39440cfe94c372c664ddeffab2f637b0
SSDEEP

3072:szyP/EBc2jrORnQssIJZYKcgtHhGk528yJKY8/d7epmB98g89QP2EKOBzWk2:szyXEBc2jMQsdJdBgHJ+/dB9rP2GR

Score

10^/10

conti discovery ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- xjQQ6zI9IWv1N6QnV5qrfoU1pTTuYIo23yPKUNgQjSoHd9dGOKNlScc9CP8Mi8pm ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Renames multiple (143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe

description	ioc	process
File opened for modification	C:\Program Files\DVD Maker\rtstreamsource.ax	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\soniccolorconverter.ax	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\Java\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\Microsoft Games\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Common Files\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\UnprotectDeny.tiff	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\UnpublishAdd.001	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\DVD Maker\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\bod_r.TTF	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\Uninstall Information\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\PublishRead.vbe	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\SelectOpen.otf	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\omni.ja	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Reference Assemblies\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Uninstall Information\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\offset.ax	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\install.log	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Google\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\SetBackup.TS	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\Google\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ie9props.propdesc	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Microsoft.NET\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\ImportSkip.inf	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\fieldswitch.ax	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\Mozilla Firefox\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\Reference Assemblies\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\MoveComplete.doc	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\sonicsptransform.ax	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsink.ax	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\installation_telemetry.json	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files\MSBuild\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\BlockOpen.xlt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\SelectRemove.aifc	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\WaitUnlock.DVR-MS	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\ExpandEnter.search-ms	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Internet Explorer\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\RevokeHide.docm	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.cfg	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\RestoreExport.7z	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Internet Explorer\ie9props.propdesc	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\LockImport.asf	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\OutCompare.shtml	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\PopLimit.easmx	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\ExitJoin.xla	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File created	C:\Program Files (x86)\readme.txt	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\DVD Maker\Eurosti.TTF	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe

pid process

1532 d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe

pid	process
1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1720	vssvc.exe
Token: SeRestorePrivilege	1720	vssvc.exe
Token: SeAuditPrivilege	1720	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2968	WMIC.exe
Token: SeSecurityPrivilege	2968	WMIC.exe
Token: SeTakeOwnershipPrivilege	2968	WMIC.exe
Token: SeLoadDriverPrivilege	2968	WMIC.exe
Token: SeSystemProfilePrivilege	2968	WMIC.exe
Token: SeSystemtimePrivilege	2968	WMIC.exe
Token: SeProfSingleProcessPrivilege	2968	WMIC.exe
Token: SeIncBasePriorityPrivilege	2968	WMIC.exe
Token: SeCreatePagefilePrivilege	2968	WMIC.exe
Token: SeBackupPrivilege	2968	WMIC.exe
Token: SeRestorePrivilege	2968	WMIC.exe
Token: SeShutdownPrivilege	2968	WMIC.exe
Token: SeDebugPrivilege	2968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2968	WMIC.exe
Token: SeRemoteShutdownPrivilege	2968	WMIC.exe
Token: SeUndockPrivilege	2968	WMIC.exe
Token: SeManageVolumePrivilege	2968	WMIC.exe
Token: 33	2968	WMIC.exe
Token: 34	2968	WMIC.exe
Token: 35	2968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2968	WMIC.exe
Token: SeSecurityPrivilege	2968	WMIC.exe
Token: SeTakeOwnershipPrivilege	2968	WMIC.exe
Token: SeLoadDriverPrivilege	2968	WMIC.exe
Token: SeSystemProfilePrivilege	2968	WMIC.exe
Token: SeSystemtimePrivilege	2968	WMIC.exe
Token: SeProfSingleProcessPrivilege	2968	WMIC.exe
Token: SeIncBasePriorityPrivilege	2968	WMIC.exe
Token: SeCreatePagefilePrivilege	2968	WMIC.exe
Token: SeBackupPrivilege	2968	WMIC.exe
Token: SeRestorePrivilege	2968	WMIC.exe
Token: SeShutdownPrivilege	2968	WMIC.exe
Token: SeDebugPrivilege	2968	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2968	WMIC.exe
Token: SeRemoteShutdownPrivilege	2968	WMIC.exe
Token: SeUndockPrivilege	2968	WMIC.exe
Token: SeManageVolumePrivilege	2968	WMIC.exe
Token: 33	2968	WMIC.exe
Token: 34	2968	WMIC.exe
Token: 35	2968	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3040	WMIC.exe
Token: SeSecurityPrivilege	3040	WMIC.exe
Token: SeTakeOwnershipPrivilege	3040	WMIC.exe
Token: SeLoadDriverPrivilege	3040	WMIC.exe
Token: SeSystemProfilePrivilege	3040	WMIC.exe
Token: SeSystemtimePrivilege	3040	WMIC.exe
Token: SeProfSingleProcessPrivilege	3040	WMIC.exe
Token: SeIncBasePriorityPrivilege	3040	WMIC.exe
Token: SeCreatePagefilePrivilege	3040	WMIC.exe
Token: SeBackupPrivilege	3040	WMIC.exe
Token: SeRestorePrivilege	3040	WMIC.exe
Token: SeShutdownPrivilege	3040	WMIC.exe
Token: SeDebugPrivilege	3040	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3040	WMIC.exe
Token: SeRemoteShutdownPrivilege	3040	WMIC.exe
Token: SeUndockPrivilege	3040	WMIC.exe
Token: SeManageVolumePrivilege	3040	WMIC.exe
Token: 33	3040	WMIC.exe
Token: 34	3040	WMIC.exe
Token: 35	3040	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3040	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1532 wrote to memory of 2076	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2076	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2076	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2076	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 2076 wrote to memory of 2968	2076	cmd.exe	WMIC.exe
PID 2076 wrote to memory of 2968	2076	cmd.exe	WMIC.exe
PID 2076 wrote to memory of 2968	2076	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 2116	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2116	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2116	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2116	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 2116 wrote to memory of 3040	2116	cmd.exe	WMIC.exe
PID 2116 wrote to memory of 3040	2116	cmd.exe	WMIC.exe
PID 2116 wrote to memory of 3040	2116	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 2708	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2708	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2708	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2708	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 2708 wrote to memory of 2712	2708	cmd.exe	WMIC.exe
PID 2708 wrote to memory of 2712	2708	cmd.exe	WMIC.exe
PID 2708 wrote to memory of 2712	2708	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 2592	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2592	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2592	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2592	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 2592 wrote to memory of 2684	2592	cmd.exe	WMIC.exe
PID 2592 wrote to memory of 2684	2592	cmd.exe	WMIC.exe
PID 2592 wrote to memory of 2684	2592	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 2720	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2720	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2720	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2720	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 2720 wrote to memory of 760	2720	cmd.exe	WMIC.exe
PID 2720 wrote to memory of 760	2720	cmd.exe	WMIC.exe
PID 2720 wrote to memory of 760	2720	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 1764	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 1764	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 1764	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 1764	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1764 wrote to memory of 1184	1764	cmd.exe	WMIC.exe
PID 1764 wrote to memory of 1184	1764	cmd.exe	WMIC.exe
PID 1764 wrote to memory of 1184	1764	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 2500	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2500	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2500	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2500	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 2500 wrote to memory of 2552	2500	cmd.exe	WMIC.exe
PID 2500 wrote to memory of 2552	2500	cmd.exe	WMIC.exe
PID 2500 wrote to memory of 2552	2500	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 2240	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2240	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2240	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 2240	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 2240 wrote to memory of 1856	2240	cmd.exe	WMIC.exe
PID 2240 wrote to memory of 1856	2240	cmd.exe	WMIC.exe
PID 2240 wrote to memory of 1856	2240	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 464	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 464	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 464	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 1532 wrote to memory of 464	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe
PID 464 wrote to memory of 1860	464	cmd.exe	WMIC.exe
PID 464 wrote to memory of 1860	464	cmd.exe	WMIC.exe
PID 464 wrote to memory of 1860	464	cmd.exe	WMIC.exe
PID 1532 wrote to memory of 1872	1532	d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe
"C:\Users\Admin\AppData\Local\Temp\d8a82bc5e15394a711849b08da79e6c42c74092497a0ef6f623ea5e8b7c6d08e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{114FEB11-1D2C-4EBD-9FE3-460FEDCE7D1C}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{114FEB11-1D2C-4EBD-9FE3-460FEDCE7D1C}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DFB62530-39DF-4AF1-BA3F-5C49383B0D41}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DFB62530-39DF-4AF1-BA3F-5C49383B0D41}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F2BDEC03-18F3-4EA9-ABD4-D53CDBF9E0AC}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F2BDEC03-18F3-4EA9-ABD4-D53CDBF9E0AC}'" delete
    3⤵
    PID:2712
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6F47B8E0-A76F-42B8-80C5-2B902F5E5749}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6F47B8E0-A76F-42B8-80C5-2B902F5E5749}'" delete
    3⤵
    PID:2684
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{021F038D-EF98-4277-807F-D9D2C31761FE}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{021F038D-EF98-4277-807F-D9D2C31761FE}'" delete
    3⤵
    PID:760
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{522CFB70-E966-4631-B951-39079840FC86}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{522CFB70-E966-4631-B951-39079840FC86}'" delete
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39A60542-2909-4674-A9B2-FCD89B71F373}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{39A60542-2909-4674-A9B2-FCD89B71F373}'" delete
    3⤵
    PID:2552
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{09D614CE-B995-49B2-AD78-718627D30B0D}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{09D614CE-B995-49B2-AD78-718627D30B0D}'" delete
    3⤵
    PID:1856
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9A213CE1-2A1D-4404-85E9-A877A57FF56E}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9A213CE1-2A1D-4404-85E9-A877A57FF56E}'" delete
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{07126393-5C20-4FEC-84EB-08FDE444B0C2}'" delete
  2⤵
  PID:1872
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{07126393-5C20-4FEC-84EB-08FDE444B0C2}'" delete
    3⤵
    PID:1656
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{569F095D-1CBC-4EAB-A3CC-4EDACD8A6278}'" delete
  2⤵
  PID:1780
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{569F095D-1CBC-4EAB-A3CC-4EDACD8A6278}'" delete
    3⤵
    PID:1512
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{25D60D36-2134-4703-B70F-C1E5670E2758}'" delete
  2⤵
  PID:2392
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{25D60D36-2134-4703-B70F-C1E5670E2758}'" delete
    3⤵
    PID:1732
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E62387E8-4164-4550-873D-246FB783FDA4}'" delete
  2⤵
  PID:1828
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E62387E8-4164-4550-873D-246FB783FDA4}'" delete
    3⤵
    PID:344
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EBF372D1-ABDA-4550-BCFA-E589781243CB}'" delete
  2⤵
  PID:2476
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{EBF372D1-ABDA-4550-BCFA-E589781243CB}'" delete
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{223604F6-39C9-4351-83D1-90EEE67EC572}'" delete
  2⤵
  PID:2820
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{223604F6-39C9-4351-83D1-90EEE67EC572}'" delete
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E3902E7F-7A32-4261-A3EE-B17FE1936361}'" delete
  2⤵
  PID:2772
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E3902E7F-7A32-4261-A3EE-B17FE1936361}'" delete
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7CD00F17-C743-4154-B479-2E288FF81CB4}'" delete
  2⤵
  PID:440
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7CD00F17-C743-4154-B479-2E288FF81CB4}'" delete
    3⤵
    PID:480
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{47BC8E53-5A59-4C7C-AEF0-C0F1C41CFCA7}'" delete
  2⤵
  PID:1528
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{47BC8E53-5A59-4C7C-AEF0-C0F1C41CFCA7}'" delete
    3⤵
    PID:1336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
701579edee1063d1b39f483e86fbed79

SHA1
ba728b45f74c8fb9fe7cf1e9c01663283c3a06d2

SHA256
93aed46310470f2aa10dd3626ed13ae15819c9417497c01b22865664ec01afc8

SHA512
7e1ed8fab572f38325b1b0eb9e1b2afae438cf8387eb19d07481d2f09ed00416368701abec1d9c046947a42809ee83dd7859b159876837ff31ef2c23f2d67c96

Download Submit