Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
Resource
win10v2004-20240802-en
General
-
Target
56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe
-
Size
514KB
-
MD5
e16d9fea42a12e877198f687ee023e63
-
SHA1
5e84f5034c4372b8674eb4099da75c398c904955
-
SHA256
56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3
-
SHA512
2c9894f9abf9c3e7d544b6112510a689119fc0f118f614d86d868c1238fe696484d43e0a0a638c1f2a0c4d8b1a21fe524ffe2df6e6e06e6d7c206b69f57c7322
-
SSDEEP
3072:8vOXfbBI4++rye6iLfv7FizEPB5Oe4UKXqlc8Lm87wgZPzOmem0:nXzin6jwUKXSL/hLOH
Malware Config
Extracted
C:\Program Files (x86)\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.ws
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Renames multiple (7955) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01560_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CAMERA.WAV 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jre7\lib\javafx.properties 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN02724_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196400.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\CollectSignatures_Init.xsn 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALENDAR.XML 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files\Microsoft Games\Mahjong\de-DE\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107146.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Monterrey 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EADOCUMENTAPPROVAL_REVIEW.XSN 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21304_.GIF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKACCL.ICO 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00367_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107344.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00382_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00428_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_it.properties 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00127_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02958_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107728.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00391_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.TTS 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196142.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Perspective.xml 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\background.gif 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285822.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN065.XML 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\NETWORK.INF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR39F.GIF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mexico_City 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00256_.WMF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File created C:\Program Files\VideoLAN\VLC\locale\am\readme.txt 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2164 vssvc.exe Token: SeRestorePrivilege 2164 vssvc.exe Token: SeAuditPrivilege 2164 vssvc.exe Token: SeIncreaseQuotaPrivilege 2620 WMIC.exe Token: SeSecurityPrivilege 2620 WMIC.exe Token: SeTakeOwnershipPrivilege 2620 WMIC.exe Token: SeLoadDriverPrivilege 2620 WMIC.exe Token: SeSystemProfilePrivilege 2620 WMIC.exe Token: SeSystemtimePrivilege 2620 WMIC.exe Token: SeProfSingleProcessPrivilege 2620 WMIC.exe Token: SeIncBasePriorityPrivilege 2620 WMIC.exe Token: SeCreatePagefilePrivilege 2620 WMIC.exe Token: SeBackupPrivilege 2620 WMIC.exe Token: SeRestorePrivilege 2620 WMIC.exe Token: SeShutdownPrivilege 2620 WMIC.exe Token: SeDebugPrivilege 2620 WMIC.exe Token: SeSystemEnvironmentPrivilege 2620 WMIC.exe Token: SeRemoteShutdownPrivilege 2620 WMIC.exe Token: SeUndockPrivilege 2620 WMIC.exe Token: SeManageVolumePrivilege 2620 WMIC.exe Token: 33 2620 WMIC.exe Token: 34 2620 WMIC.exe Token: 35 2620 WMIC.exe Token: SeIncreaseQuotaPrivilege 2620 WMIC.exe Token: SeSecurityPrivilege 2620 WMIC.exe Token: SeTakeOwnershipPrivilege 2620 WMIC.exe Token: SeLoadDriverPrivilege 2620 WMIC.exe Token: SeSystemProfilePrivilege 2620 WMIC.exe Token: SeSystemtimePrivilege 2620 WMIC.exe Token: SeProfSingleProcessPrivilege 2620 WMIC.exe Token: SeIncBasePriorityPrivilege 2620 WMIC.exe Token: SeCreatePagefilePrivilege 2620 WMIC.exe Token: SeBackupPrivilege 2620 WMIC.exe Token: SeRestorePrivilege 2620 WMIC.exe Token: SeShutdownPrivilege 2620 WMIC.exe Token: SeDebugPrivilege 2620 WMIC.exe Token: SeSystemEnvironmentPrivilege 2620 WMIC.exe Token: SeRemoteShutdownPrivilege 2620 WMIC.exe Token: SeUndockPrivilege 2620 WMIC.exe Token: SeManageVolumePrivilege 2620 WMIC.exe Token: 33 2620 WMIC.exe Token: 34 2620 WMIC.exe Token: 35 2620 WMIC.exe Token: SeIncreaseQuotaPrivilege 3020 WMIC.exe Token: SeSecurityPrivilege 3020 WMIC.exe Token: SeTakeOwnershipPrivilege 3020 WMIC.exe Token: SeLoadDriverPrivilege 3020 WMIC.exe Token: SeSystemProfilePrivilege 3020 WMIC.exe Token: SeSystemtimePrivilege 3020 WMIC.exe Token: SeProfSingleProcessPrivilege 3020 WMIC.exe Token: SeIncBasePriorityPrivilege 3020 WMIC.exe Token: SeCreatePagefilePrivilege 3020 WMIC.exe Token: SeBackupPrivilege 3020 WMIC.exe Token: SeRestorePrivilege 3020 WMIC.exe Token: SeShutdownPrivilege 3020 WMIC.exe Token: SeDebugPrivilege 3020 WMIC.exe Token: SeSystemEnvironmentPrivilege 3020 WMIC.exe Token: SeRemoteShutdownPrivilege 3020 WMIC.exe Token: SeUndockPrivilege 3020 WMIC.exe Token: SeManageVolumePrivilege 3020 WMIC.exe Token: 33 3020 WMIC.exe Token: 34 3020 WMIC.exe Token: 35 3020 WMIC.exe Token: SeIncreaseQuotaPrivilege 3020 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2580 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 33 PID 2708 wrote to memory of 2580 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 33 PID 2708 wrote to memory of 2580 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 33 PID 2708 wrote to memory of 2580 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 33 PID 2580 wrote to memory of 2620 2580 cmd.exe 35 PID 2580 wrote to memory of 2620 2580 cmd.exe 35 PID 2580 wrote to memory of 2620 2580 cmd.exe 35 PID 2708 wrote to memory of 3012 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 36 PID 2708 wrote to memory of 3012 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 36 PID 2708 wrote to memory of 3012 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 36 PID 2708 wrote to memory of 3012 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 36 PID 3012 wrote to memory of 3020 3012 cmd.exe 38 PID 3012 wrote to memory of 3020 3012 cmd.exe 38 PID 3012 wrote to memory of 3020 3012 cmd.exe 38 PID 2708 wrote to memory of 408 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 39 PID 2708 wrote to memory of 408 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 39 PID 2708 wrote to memory of 408 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 39 PID 2708 wrote to memory of 408 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 39 PID 408 wrote to memory of 876 408 cmd.exe 41 PID 408 wrote to memory of 876 408 cmd.exe 41 PID 408 wrote to memory of 876 408 cmd.exe 41 PID 2708 wrote to memory of 2956 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 42 PID 2708 wrote to memory of 2956 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 42 PID 2708 wrote to memory of 2956 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 42 PID 2708 wrote to memory of 2956 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 42 PID 2956 wrote to memory of 2748 2956 cmd.exe 44 PID 2956 wrote to memory of 2748 2956 cmd.exe 44 PID 2956 wrote to memory of 2748 2956 cmd.exe 44 PID 2708 wrote to memory of 2432 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 45 PID 2708 wrote to memory of 2432 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 45 PID 2708 wrote to memory of 2432 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 45 PID 2708 wrote to memory of 2432 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 45 PID 2432 wrote to memory of 2540 2432 cmd.exe 47 PID 2432 wrote to memory of 2540 2432 cmd.exe 47 PID 2432 wrote to memory of 2540 2432 cmd.exe 47 PID 2708 wrote to memory of 532 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 48 PID 2708 wrote to memory of 532 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 48 PID 2708 wrote to memory of 532 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 48 PID 2708 wrote to memory of 532 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 48 PID 532 wrote to memory of 1584 532 cmd.exe 50 PID 532 wrote to memory of 1584 532 cmd.exe 50 PID 532 wrote to memory of 1584 532 cmd.exe 50 PID 2708 wrote to memory of 1708 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 51 PID 2708 wrote to memory of 1708 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 51 PID 2708 wrote to memory of 1708 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 51 PID 2708 wrote to memory of 1708 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 51 PID 1708 wrote to memory of 2216 1708 cmd.exe 53 PID 1708 wrote to memory of 2216 1708 cmd.exe 53 PID 1708 wrote to memory of 2216 1708 cmd.exe 53 PID 2708 wrote to memory of 1944 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 54 PID 2708 wrote to memory of 1944 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 54 PID 2708 wrote to memory of 1944 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 54 PID 2708 wrote to memory of 1944 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 54 PID 1944 wrote to memory of 332 1944 cmd.exe 56 PID 1944 wrote to memory of 332 1944 cmd.exe 56 PID 1944 wrote to memory of 332 1944 cmd.exe 56 PID 2708 wrote to memory of 2392 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 57 PID 2708 wrote to memory of 2392 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 57 PID 2708 wrote to memory of 2392 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 57 PID 2708 wrote to memory of 2392 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 57 PID 2392 wrote to memory of 2332 2392 cmd.exe 59 PID 2392 wrote to memory of 2332 2392 cmd.exe 59 PID 2392 wrote to memory of 2332 2392 cmd.exe 59 PID 2708 wrote to memory of 1488 2708 56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe 60 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe"C:\Users\Admin\AppData\Local\Temp\56f74f8c33cfa60be0f3b8936978a6d31c3c57eb3e4e00bd7a794da9b3ecd7b3.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2694AF99-FDF7-49F7-B181-A2004D5482B1}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2694AF99-FDF7-49F7-B181-A2004D5482B1}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A80DE52-B0CB-41B0-9669-313B2599E475}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2A80DE52-B0CB-41B0-9669-313B2599E475}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73C5C1C0-3F77-45F6-B50F-23BDC2C02E98}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{73C5C1C0-3F77-45F6-B50F-23BDC2C02E98}'" delete3⤵PID:876
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2DEACCA9-045C-4866-8437-90AD68CCCB0C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2DEACCA9-045C-4866-8437-90AD68CCCB0C}'" delete3⤵PID:2748
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{162056E6-9C86-4ED1-836E-5F89AA0EFFBA}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{162056E6-9C86-4ED1-836E-5F89AA0EFFBA}'" delete3⤵PID:2540
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4C33247-29E3-45A6-AD37-56B389A599B4}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E4C33247-29E3-45A6-AD37-56B389A599B4}'" delete3⤵PID:1584
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DCF8E05D-0974-4DAC-888B-3035D8D322A9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{DCF8E05D-0974-4DAC-888B-3035D8D322A9}'" delete3⤵PID:2216
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{85B548A2-CB8A-4CB1-9850-48087069BEAF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{85B548A2-CB8A-4CB1-9850-48087069BEAF}'" delete3⤵PID:332
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3088B38E-281C-4CE5-BD17-2833A615E25C}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3088B38E-281C-4CE5-BD17-2833A615E25C}'" delete3⤵PID:2332
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A2E772B6-4BC9-4135-A446-B7056CD0C2E6}'" delete2⤵PID:1488
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A2E772B6-4BC9-4135-A446-B7056CD0C2E6}'" delete3⤵PID:1648
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{09B65AED-511B-48D2-B04C-DBFB47B36371}'" delete2⤵PID:1700
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{09B65AED-511B-48D2-B04C-DBFB47B36371}'" delete3⤵PID:2436
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7CDEB008-C24C-47D4-8207-2D68EBF5A0D0}'" delete2⤵PID:1256
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7CDEB008-C24C-47D4-8207-2D68EBF5A0D0}'" delete3⤵PID:2396
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3531FB7-3B78-4B74-9F87-BDF5E277A498}'" delete2⤵PID:1168
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F3531FB7-3B78-4B74-9F87-BDF5E277A498}'" delete3⤵PID:2000
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FE562E1E-046A-4042-BCEE-28FCA0DD5DD2}'" delete2⤵PID:764
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FE562E1E-046A-4042-BCEE-28FCA0DD5DD2}'" delete3⤵PID:960
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3E5DC812-7A9B-4AAC-9FCA-D404103283B4}'" delete2⤵PID:548
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3E5DC812-7A9B-4AAC-9FCA-D404103283B4}'" delete3⤵PID:1672
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{51DCF14C-5695-41B4-866E-6E434D914D77}'" delete2⤵PID:1800
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{51DCF14C-5695-41B4-866E-6E434D914D77}'" delete3⤵PID:892
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{30B1EF98-A88B-4190-A656-8079645E317F}'" delete2⤵PID:1960
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{30B1EF98-A88B-4190-A656-8079645E317F}'" delete3⤵PID:1788
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1A11EC94-9E83-4CCA-96AA-0F67FADCFA7F}'" delete2⤵PID:1888
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1A11EC94-9E83-4CCA-96AA-0F67FADCFA7F}'" delete3⤵PID:1308
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ac912958d8ddded9bb3117498e76ac41
SHA1a818e44237b79ef828026c6530465a6ff6a17fd5
SHA256da04404dcf44a4f0078819d3dfa9261e52a50d29ed379a75a6bd160e7bde02b2
SHA512fb64251c4cf63f9df40b1738613fa13eddcc06e9d86246215fd38281d1b2e137308a26f9853f3f80edb4f5d01ccf9dc647bf7c7895527806b8cc705eb6e3ef0e