conti | 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
Size

514KB
MD5

e16d9fea42a12e877198f687ee023e63
SHA1

5e84f5034c4372b8674eb4099da75c398c904955
SHA256

56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3
SHA512

2c9894f9abf9c3e7d544b6112510a689119fc0f118f614d86d868c1238fe696484d43e0a0a638c1f2a0c4d8b1a21fe524ffe2df6e6e06e6d7c206b69f57c7322
SSDEEP

3072:8vOXfbBI4++rye6iLfv7FizEPB5Oe4UKXqlc8Lm87wgZPzOmem0:nXzin6jwUKXSL/hLOH

Score

10^/10

conti credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.ws YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- fqAM1Wjx6ZFKZezjt1CnsVfuNcsFUvsiwLgufIXADXkqyWAWww27zBekvcfCaTzh ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.ws

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Renames multiple (7955) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01560_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CAMERA.WAV	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\javafx.properties	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196400.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Init.xsn	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALENDAR.XML	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Monterrey	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21304_.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKACCL.ICO	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00367_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107344.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00127_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02958_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107728.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00391_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.TTS	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\background.gif	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN065.XML	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\NETWORK.INF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR39F.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\readme.txt	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2164	vssvc.exe
Token: SeRestorePrivilege	2164	vssvc.exe
Token: SeAuditPrivilege	2164	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2620	WMIC.exe
Token: SeSecurityPrivilege	2620	WMIC.exe
Token: SeTakeOwnershipPrivilege	2620	WMIC.exe
Token: SeLoadDriverPrivilege	2620	WMIC.exe
Token: SeSystemProfilePrivilege	2620	WMIC.exe
Token: SeSystemtimePrivilege	2620	WMIC.exe
Token: SeProfSingleProcessPrivilege	2620	WMIC.exe
Token: SeIncBasePriorityPrivilege	2620	WMIC.exe
Token: SeCreatePagefilePrivilege	2620	WMIC.exe
Token: SeBackupPrivilege	2620	WMIC.exe
Token: SeRestorePrivilege	2620	WMIC.exe
Token: SeShutdownPrivilege	2620	WMIC.exe
Token: SeDebugPrivilege	2620	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2620	WMIC.exe
Token: SeRemoteShutdownPrivilege	2620	WMIC.exe
Token: SeUndockPrivilege	2620	WMIC.exe
Token: SeManageVolumePrivilege	2620	WMIC.exe
Token: 33	2620	WMIC.exe
Token: 34	2620	WMIC.exe
Token: 35	2620	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2620	WMIC.exe
Token: SeSecurityPrivilege	2620	WMIC.exe
Token: SeTakeOwnershipPrivilege	2620	WMIC.exe
Token: SeLoadDriverPrivilege	2620	WMIC.exe
Token: SeSystemProfilePrivilege	2620	WMIC.exe
Token: SeSystemtimePrivilege	2620	WMIC.exe
Token: SeProfSingleProcessPrivilege	2620	WMIC.exe
Token: SeIncBasePriorityPrivilege	2620	WMIC.exe
Token: SeCreatePagefilePrivilege	2620	WMIC.exe
Token: SeBackupPrivilege	2620	WMIC.exe
Token: SeRestorePrivilege	2620	WMIC.exe
Token: SeShutdownPrivilege	2620	WMIC.exe
Token: SeDebugPrivilege	2620	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2620	WMIC.exe
Token: SeRemoteShutdownPrivilege	2620	WMIC.exe
Token: SeUndockPrivilege	2620	WMIC.exe
Token: SeManageVolumePrivilege	2620	WMIC.exe
Token: 33	2620	WMIC.exe
Token: 34	2620	WMIC.exe
Token: 35	2620	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3020	WMIC.exe
Token: SeSecurityPrivilege	3020	WMIC.exe
Token: SeTakeOwnershipPrivilege	3020	WMIC.exe
Token: SeLoadDriverPrivilege	3020	WMIC.exe
Token: SeSystemProfilePrivilege	3020	WMIC.exe
Token: SeSystemtimePrivilege	3020	WMIC.exe
Token: SeProfSingleProcessPrivilege	3020	WMIC.exe
Token: SeIncBasePriorityPrivilege	3020	WMIC.exe
Token: SeCreatePagefilePrivilege	3020	WMIC.exe
Token: SeBackupPrivilege	3020	WMIC.exe
Token: SeRestorePrivilege	3020	WMIC.exe
Token: SeShutdownPrivilege	3020	WMIC.exe
Token: SeDebugPrivilege	3020	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3020	WMIC.exe
Token: SeRemoteShutdownPrivilege	3020	WMIC.exe
Token: SeUndockPrivilege	3020	WMIC.exe
Token: SeManageVolumePrivilege	3020	WMIC.exe
Token: 33	3020	WMIC.exe
Token: 34	3020	WMIC.exe
Token: 35	3020	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3020	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2580	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 2708 wrote to memory of 2580	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 2708 wrote to memory of 2580	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 2708 wrote to memory of 2580	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	33
PID 2580 wrote to memory of 2620	2580	cmd.exe	35
PID 2580 wrote to memory of 2620	2580	cmd.exe	35
PID 2580 wrote to memory of 2620	2580	cmd.exe	35
PID 2708 wrote to memory of 3012	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 2708 wrote to memory of 3012	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 2708 wrote to memory of 3012	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 2708 wrote to memory of 3012	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	36
PID 3012 wrote to memory of 3020	3012	cmd.exe	38
PID 3012 wrote to memory of 3020	3012	cmd.exe	38
PID 3012 wrote to memory of 3020	3012	cmd.exe	38
PID 2708 wrote to memory of 408	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 2708 wrote to memory of 408	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 2708 wrote to memory of 408	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 2708 wrote to memory of 408	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	39
PID 408 wrote to memory of 876	408	cmd.exe	41
PID 408 wrote to memory of 876	408	cmd.exe	41
PID 408 wrote to memory of 876	408	cmd.exe	41
PID 2708 wrote to memory of 2956	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 2708 wrote to memory of 2956	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 2708 wrote to memory of 2956	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 2708 wrote to memory of 2956	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	42
PID 2956 wrote to memory of 2748	2956	cmd.exe	44
PID 2956 wrote to memory of 2748	2956	cmd.exe	44
PID 2956 wrote to memory of 2748	2956	cmd.exe	44
PID 2708 wrote to memory of 2432	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 2708 wrote to memory of 2432	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 2708 wrote to memory of 2432	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 2708 wrote to memory of 2432	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	45
PID 2432 wrote to memory of 2540	2432	cmd.exe	47
PID 2432 wrote to memory of 2540	2432	cmd.exe	47
PID 2432 wrote to memory of 2540	2432	cmd.exe	47
PID 2708 wrote to memory of 532	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 2708 wrote to memory of 532	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 2708 wrote to memory of 532	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 2708 wrote to memory of 532	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	48
PID 532 wrote to memory of 1584	532	cmd.exe	50
PID 532 wrote to memory of 1584	532	cmd.exe	50
PID 532 wrote to memory of 1584	532	cmd.exe	50
PID 2708 wrote to memory of 1708	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 2708 wrote to memory of 1708	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 2708 wrote to memory of 1708	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 2708 wrote to memory of 1708	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	51
PID 1708 wrote to memory of 2216	1708	cmd.exe	53
PID 1708 wrote to memory of 2216	1708	cmd.exe	53
PID 1708 wrote to memory of 2216	1708	cmd.exe	53
PID 2708 wrote to memory of 1944	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 2708 wrote to memory of 1944	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 2708 wrote to memory of 1944	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 2708 wrote to memory of 1944	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	54
PID 1944 wrote to memory of 332	1944	cmd.exe	56
PID 1944 wrote to memory of 332	1944	cmd.exe	56
PID 1944 wrote to memory of 332	1944	cmd.exe	56
PID 2708 wrote to memory of 2392	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 2708 wrote to memory of 2392	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 2708 wrote to memory of 2392	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 2708 wrote to memory of 2392	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	57
PID 2392 wrote to memory of 2332	2392	cmd.exe	59
PID 2392 wrote to memory of 2332	2392	cmd.exe	59
PID 2392 wrote to memory of 2332	2392	cmd.exe	59
PID 2708 wrote to memory of 1488	2708	56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe	60

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
"C:\Users\Admin\AppData\Local\Temp\56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2694AF99-FDF7-49F7-B181-A2004D5482B1}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2694AF99-FDF7-49F7-B181-A2004D5482B1}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A80DE52-B0CB-41B0-9669-313B2599E475}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A80DE52-B0CB-41B0-9669-313B2599E475}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73C5C1C0-3F77-45F6-B50F-23BDC2C02E98}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73C5C1C0-3F77-45F6-B50F-23BDC2C02E98}'" delete
    3⤵
    PID:876
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2DEACCA9-045C-4866-8437-90AD68CCCB0C}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2DEACCA9-045C-4866-8437-90AD68CCCB0C}'" delete
    3⤵
    PID:2748
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{162056E6-9C86-4ED1-836E-5F89AA0EFFBA}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{162056E6-9C86-4ED1-836E-5F89AA0EFFBA}'" delete
    3⤵
    PID:2540
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4C33247-29E3-45A6-AD37-56B389A599B4}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4C33247-29E3-45A6-AD37-56B389A599B4}'" delete
    3⤵
    PID:1584
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DCF8E05D-0974-4DAC-888B-3035D8D322A9}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DCF8E05D-0974-4DAC-888B-3035D8D322A9}'" delete
    3⤵
    PID:2216
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{85B548A2-CB8A-4CB1-9850-48087069BEAF}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{85B548A2-CB8A-4CB1-9850-48087069BEAF}'" delete
    3⤵
    PID:332
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3088B38E-281C-4CE5-BD17-2833A615E25C}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3088B38E-281C-4CE5-BD17-2833A615E25C}'" delete
    3⤵
    PID:2332
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A2E772B6-4BC9-4135-A446-B7056CD0C2E6}'" delete
  2⤵
  PID:1488
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A2E772B6-4BC9-4135-A446-B7056CD0C2E6}'" delete
    3⤵
    PID:1648
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{09B65AED-511B-48D2-B04C-DBFB47B36371}'" delete
  2⤵
  PID:1700
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{09B65AED-511B-48D2-B04C-DBFB47B36371}'" delete
    3⤵
    PID:2436
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7CDEB008-C24C-47D4-8207-2D68EBF5A0D0}'" delete
  2⤵
  PID:1256
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7CDEB008-C24C-47D4-8207-2D68EBF5A0D0}'" delete
    3⤵
    PID:2396
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3531FB7-3B78-4B74-9F87-BDF5E277A498}'" delete
  2⤵
  PID:1168
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3531FB7-3B78-4B74-9F87-BDF5E277A498}'" delete
    3⤵
    PID:2000
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FE562E1E-046A-4042-BCEE-28FCA0DD5DD2}'" delete
  2⤵
  PID:764
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FE562E1E-046A-4042-BCEE-28FCA0DD5DD2}'" delete
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3E5DC812-7A9B-4AAC-9FCA-D404103283B4}'" delete
  2⤵
  PID:548
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3E5DC812-7A9B-4AAC-9FCA-D404103283B4}'" delete
    3⤵
    PID:1672
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{51DCF14C-5695-41B4-866E-6E434D914D77}'" delete
  2⤵
  PID:1800
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{51DCF14C-5695-41B4-866E-6E434D914D77}'" delete
    3⤵
    PID:892
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{30B1EF98-A88B-4190-A656-8079645E317F}'" delete
  2⤵
  PID:1960
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{30B1EF98-A88B-4190-A656-8079645E317F}'" delete
    3⤵
    PID:1788
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1A11EC94-9E83-4CCA-96AA-0F67FADCFA7F}'" delete
  2⤵
  PID:1888
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1A11EC94-9E83-4CCA-96AA-0F67FADCFA7F}'" delete
    3⤵
    PID:1308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
ac912958d8ddded9bb3117498e76ac41

SHA1
a818e44237b79ef828026c6530465a6ff6a17fd5

SHA256
da04404dcf44a4f0078819d3dfa9261e52a50d29ed379a75a6bd160e7bde02b2

SHA512
fb64251c4cf63f9df40b1738613fa13eddcc06e9d86246215fd38281d1b2e137308a26f9853f3f80edb4f5d01ccf9dc647bf7c7895527806b8cc705eb6e3ef0e

Download Submit