conti | 132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
Size

515KB
MD5

b9c56e7c05c5861cecbc3d99bf056c6a
SHA1

1306b87b4ffbe513e19225d0bf5719f5f078e077
SHA256

132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e
SHA512

846666b9c0dc106931e7cbca61d759bc75aac5083bed636b8f00a9d2649c2f0d428515fd0d38e8f9d5879994681c97ce7c7d56031e0e821702240f4a6f54a96a
SSDEEP

3072:HzyJa/EBc2jrORnQssIJZYKcgtHhGk528yJKY8/d7epmB98g89QP2EKO0+5Wk:HzymEBc2jMQsdJdBgHJ+/dB9rP2v+5R

Score

10^/10

conti discovery ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- ec5sSORrGN3JYtjUtK7QvDv7ZtnFwgcUnCEmqJITc9YfyoAPydlyCoE1FHyB8wCq ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Renames multiple (143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

description	ioc	process
File opened for modification	C:\Program Files\TraceBlock.mp4	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\RepairWait.xlt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\ResolveUnlock.wmf	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DenyGroup.otf	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\InitializeApprove.emz	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Uninstall Information\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\StepUse.crw	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\MSBuild\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\Java\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\MSBuild\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Reference Assemblies\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\RestoreDisconnect.au3	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\Mozilla Firefox\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\Google\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\installation_telemetry.json	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Microsoft Office\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\CompleteWait.ttf	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\InvokeExit.cfg	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsource.ax	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Internet Explorer\ie9props.propdesc	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\ProtectJoin.tif	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\Internet Explorer\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\install.log	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\OpenBlock.pptm	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\Reference Assemblies\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\Uninstall Information\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\RepairEdit.wvx	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\offset.ax	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\sonicsptransform.ax	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\ConvertToSplit.snd	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\UnblockConvertFrom.ico	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\UpdateSwitch.odt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\bod_r.TTF	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\ConnectRequest.iso	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\ImportSave.MTS	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\SecretST.TTF	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\soniccolorconverter.ax	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\ReceiveWatch.wav	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\ResumeReceive.wmf	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files\Microsoft Office\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\CompressSearch.xlsx	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\SetAdd.xla	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\postSigningData	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\audiodepthconverter.ax	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\rtstreamsink.ax	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ie9props.propdesc	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\DVD Maker\Eurosti.TTF	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\Accessible.tlb	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
File created	C:\Program Files (x86)\Internet Explorer\readme.txt	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

pid process

1840 132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

pid	process
1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	process
Token: SeBackupPrivilege	1600	vssvc.exe
Token: SeRestorePrivilege	1600	vssvc.exe
Token: SeAuditPrivilege	1600	vssvc.exe
Token: SeIncreaseQuotaPrivilege	584	WMIC.exe
Token: SeSecurityPrivilege	584	WMIC.exe
Token: SeTakeOwnershipPrivilege	584	WMIC.exe
Token: SeLoadDriverPrivilege	584	WMIC.exe
Token: SeSystemProfilePrivilege	584	WMIC.exe
Token: SeSystemtimePrivilege	584	WMIC.exe
Token: SeProfSingleProcessPrivilege	584	WMIC.exe
Token: SeIncBasePriorityPrivilege	584	WMIC.exe
Token: SeCreatePagefilePrivilege	584	WMIC.exe
Token: SeBackupPrivilege	584	WMIC.exe
Token: SeRestorePrivilege	584	WMIC.exe
Token: SeShutdownPrivilege	584	WMIC.exe
Token: SeDebugPrivilege	584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	584	WMIC.exe
Token: SeRemoteShutdownPrivilege	584	WMIC.exe
Token: SeUndockPrivilege	584	WMIC.exe
Token: SeManageVolumePrivilege	584	WMIC.exe
Token: 33	584	WMIC.exe
Token: 34	584	WMIC.exe
Token: 35	584	WMIC.exe
Token: SeIncreaseQuotaPrivilege	584	WMIC.exe
Token: SeSecurityPrivilege	584	WMIC.exe
Token: SeTakeOwnershipPrivilege	584	WMIC.exe
Token: SeLoadDriverPrivilege	584	WMIC.exe
Token: SeSystemProfilePrivilege	584	WMIC.exe
Token: SeSystemtimePrivilege	584	WMIC.exe
Token: SeProfSingleProcessPrivilege	584	WMIC.exe
Token: SeIncBasePriorityPrivilege	584	WMIC.exe
Token: SeCreatePagefilePrivilege	584	WMIC.exe
Token: SeBackupPrivilege	584	WMIC.exe
Token: SeRestorePrivilege	584	WMIC.exe
Token: SeShutdownPrivilege	584	WMIC.exe
Token: SeDebugPrivilege	584	WMIC.exe
Token: SeSystemEnvironmentPrivilege	584	WMIC.exe
Token: SeRemoteShutdownPrivilege	584	WMIC.exe
Token: SeUndockPrivilege	584	WMIC.exe
Token: SeManageVolumePrivilege	584	WMIC.exe
Token: 33	584	WMIC.exe
Token: 34	584	WMIC.exe
Token: 35	584	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2160	WMIC.exe
Token: SeSecurityPrivilege	2160	WMIC.exe
Token: SeTakeOwnershipPrivilege	2160	WMIC.exe
Token: SeLoadDriverPrivilege	2160	WMIC.exe
Token: SeSystemProfilePrivilege	2160	WMIC.exe
Token: SeSystemtimePrivilege	2160	WMIC.exe
Token: SeProfSingleProcessPrivilege	2160	WMIC.exe
Token: SeIncBasePriorityPrivilege	2160	WMIC.exe
Token: SeCreatePagefilePrivilege	2160	WMIC.exe
Token: SeBackupPrivilege	2160	WMIC.exe
Token: SeRestorePrivilege	2160	WMIC.exe
Token: SeShutdownPrivilege	2160	WMIC.exe
Token: SeDebugPrivilege	2160	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2160	WMIC.exe
Token: SeRemoteShutdownPrivilege	2160	WMIC.exe
Token: SeUndockPrivilege	2160	WMIC.exe
Token: SeManageVolumePrivilege	2160	WMIC.exe
Token: 33	2160	WMIC.exe
Token: 34	2160	WMIC.exe
Token: 35	2160	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2160	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1840 wrote to memory of 2744	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2744	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2744	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2744	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 2744 wrote to memory of 584	2744	cmd.exe	WMIC.exe
PID 2744 wrote to memory of 584	2744	cmd.exe	WMIC.exe
PID 2744 wrote to memory of 584	2744	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 2640	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2640	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2640	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2640	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 2640 wrote to memory of 2160	2640	cmd.exe	WMIC.exe
PID 2640 wrote to memory of 2160	2640	cmd.exe	WMIC.exe
PID 2640 wrote to memory of 2160	2640	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1276	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 1276	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 1276	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 1276	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1276 wrote to memory of 536	1276	cmd.exe	WMIC.exe
PID 1276 wrote to memory of 536	1276	cmd.exe	WMIC.exe
PID 1276 wrote to memory of 536	1276	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 1232	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 1232	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 1232	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 1232	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1232 wrote to memory of 2404	1232	cmd.exe	WMIC.exe
PID 1232 wrote to memory of 2404	1232	cmd.exe	WMIC.exe
PID 1232 wrote to memory of 2404	1232	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 2088	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2088	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2088	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2088	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 2088 wrote to memory of 1348	2088	cmd.exe	WMIC.exe
PID 2088 wrote to memory of 1348	2088	cmd.exe	WMIC.exe
PID 2088 wrote to memory of 1348	2088	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 2900	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2900	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2900	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2900	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 2900 wrote to memory of 348	2900	cmd.exe	WMIC.exe
PID 2900 wrote to memory of 348	2900	cmd.exe	WMIC.exe
PID 2900 wrote to memory of 348	2900	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 2788	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2788	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2788	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2788	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 2788 wrote to memory of 2812	2788	cmd.exe	WMIC.exe
PID 2788 wrote to memory of 2812	2788	cmd.exe	WMIC.exe
PID 2788 wrote to memory of 2812	2788	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 980	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 980	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 980	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 980	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 980 wrote to memory of 2884	980	cmd.exe	WMIC.exe
PID 980 wrote to memory of 2884	980	cmd.exe	WMIC.exe
PID 980 wrote to memory of 2884	980	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 2964	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2964	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2964	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 1840 wrote to memory of 2964	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe
PID 2964 wrote to memory of 2948	2964	cmd.exe	WMIC.exe
PID 2964 wrote to memory of 2948	2964	cmd.exe	WMIC.exe
PID 2964 wrote to memory of 2948	2964	cmd.exe	WMIC.exe
PID 1840 wrote to memory of 792	1840	132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe
"C:\Users\Admin\AppData\Local\Temp\132f4e074a4739dfb574b8d32d3f9ddd70a1506dd76bae33ced3ed87d1f3695e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2BD6FB29-189E-4F99-9F99-651A72FEBF02}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2BD6FB29-189E-4F99-9F99-651A72FEBF02}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:584
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D818798-4B47-458C-8916-CBECAE43B4FB}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2D818798-4B47-458C-8916-CBECAE43B4FB}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1BB337A5-A97C-4E3B-A953-6F743F6A68A9}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1BB337A5-A97C-4E3B-A953-6F743F6A68A9}'" delete
    3⤵
    PID:536
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6477892D-EC9E-4CBF-B454-FA61DC46F5FA}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6477892D-EC9E-4CBF-B454-FA61DC46F5FA}'" delete
    3⤵
    PID:2404
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56351986-B650-4647-8784-B3B760645DA4}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{56351986-B650-4647-8784-B3B760645DA4}'" delete
    3⤵
    PID:1348
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2265C065-B6B0-4775-9799-36B9FEE32622}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2265C065-B6B0-4775-9799-36B9FEE32622}'" delete
    3⤵
    PID:348
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FABF953-9C39-45E5-BBE9-8EA6C9C47AFC}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1FABF953-9C39-45E5-BBE9-8EA6C9C47AFC}'" delete
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8B936CD8-A865-4FAC-8D84-CBCB07B701E1}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8B936CD8-A865-4FAC-8D84-CBCB07B701E1}'" delete
    3⤵
    PID:2884
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6309368E-BFB6-486E-98FD-95DB63CF8CCD}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6309368E-BFB6-486E-98FD-95DB63CF8CCD}'" delete
    3⤵
    PID:2948
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C86CD55D-C4A7-41EE-9996-50648480DCD1}'" delete
  2⤵
  PID:792
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C86CD55D-C4A7-41EE-9996-50648480DCD1}'" delete
    3⤵
    PID:592
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F1EC04A3-70A5-446C-82A7-F72478B1F67F}'" delete
  2⤵
  PID:636
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F1EC04A3-70A5-446C-82A7-F72478B1F67F}'" delete
    3⤵
    PID:1880
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D0EA2D8B-0324-4D6B-B67E-47501DE36B0D}'" delete
  2⤵
  PID:560
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D0EA2D8B-0324-4D6B-B67E-47501DE36B0D}'" delete
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF511B92-0D8F-4A7D-8D02-DBF4F564E117}'" delete
  2⤵
  PID:2128
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BF511B92-0D8F-4A7D-8D02-DBF4F564E117}'" delete
    3⤵
    PID:3048
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{49B72978-0008-434A-B917-90D3B1C2A77E}'" delete
  2⤵
  PID:1740
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{49B72978-0008-434A-B917-90D3B1C2A77E}'" delete
    3⤵
    PID:1996
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA9990C9-A884-4636-9E67-9D57557C520F}'" delete
  2⤵
  PID:824
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CA9990C9-A884-4636-9E67-9D57557C520F}'" delete
    3⤵
    PID:1296
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BDBC865F-CD95-469C-87CB-A93B7E42F6FC}'" delete
  2⤵
  PID:704
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BDBC865F-CD95-469C-87CB-A93B7E42F6FC}'" delete
    3⤵
    PID:2324
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F2239B57-C45C-479E-80DD-8AD930A4200B}'" delete
  2⤵
  PID:564
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F2239B57-C45C-479E-80DD-8AD930A4200B}'" delete
    3⤵
    PID:1696
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2ECE20AD-81EF-4472-98D5-76CDE183AA48}'" delete
  2⤵
  PID:1508
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2ECE20AD-81EF-4472-98D5-76CDE183AA48}'" delete
    3⤵
    PID:1876

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
d030c401512051cf275eb9d2b61f327e

SHA1
eaf4022b5b6cd27b9e4a833d4863a3de6f65b819

SHA256
7d6b2b2e67b72d46d10f8dbf0233bd3fa94ac11d839148e305d0190268ca6edb

SHA512
e4d6864c785da9d703cc298b31f94887b914950fdb2ed635232e35baa6c4d8674fe8d327c1cde2808cbceb922136fcfe46d6591d6988125a09f414c2ec07df9d

Download Submit