conti | 3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
Size

514KB
MD5

a9989d691d4a509fba4fbc2a26bcb54f
SHA1

0e7e0d1ae5ec4d691de59892aa45ee80069e079d
SHA256

3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba
SHA512

eeae35103e66711cd8015ff4d0ee3c36eb030b5b6f326177075f5a02328ead68ebcad3f839ae3ef50bf8e4444aa9c597bd9b8ba25989ba1a2de9722d29f2b429
SSDEEP

3072:fvOXfbBI4++rye6iLfv7FizEPB5Oe4UKXqlc8Lm87wgZPyzOmem0:eXzin6jwUKXSL/hIOH

Score

10^/10

conti credential_access discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\Program Files (x86)\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.click YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- lWL5aqUDwBJQsqHmM6OkU1yOTGOiNHcCdTAyuj6A1xKUIz98qMCGpifNoPeYSXBA ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.click

Signatures

Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Renames multiple (7923) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01701_.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\vlc.mo	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV_K_COL.HXK	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Triedit\it-IT\readme.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OOFS.ICO	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OCRVC.DAT	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086428.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387578.JPG	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251301.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.IN.XML	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00200_.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00177_.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00382_.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jre7\lib\classlist	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\readme.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\readme.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_OFF.GIF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OIS.HXS	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10266_.GIF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115839.GIF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_zh_CN.jar	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\La_Paz	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10307_.GIF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_babypink_Thumbnail.bmp	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\readme.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6EXT.OLB	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10290_.GIF	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yellowknife	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\SWBELL.NET.XML	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.XML	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGDOTS.DPV	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\readme.txt	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2896	vssvc.exe
Token: SeRestorePrivilege	2896	vssvc.exe
Token: SeAuditPrivilege	2896	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2592	WMIC.exe
Token: SeSecurityPrivilege	2592	WMIC.exe
Token: SeTakeOwnershipPrivilege	2592	WMIC.exe
Token: SeLoadDriverPrivilege	2592	WMIC.exe
Token: SeSystemProfilePrivilege	2592	WMIC.exe
Token: SeSystemtimePrivilege	2592	WMIC.exe
Token: SeProfSingleProcessPrivilege	2592	WMIC.exe
Token: SeIncBasePriorityPrivilege	2592	WMIC.exe
Token: SeCreatePagefilePrivilege	2592	WMIC.exe
Token: SeBackupPrivilege	2592	WMIC.exe
Token: SeRestorePrivilege	2592	WMIC.exe
Token: SeShutdownPrivilege	2592	WMIC.exe
Token: SeDebugPrivilege	2592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2592	WMIC.exe
Token: SeRemoteShutdownPrivilege	2592	WMIC.exe
Token: SeUndockPrivilege	2592	WMIC.exe
Token: SeManageVolumePrivilege	2592	WMIC.exe
Token: 33	2592	WMIC.exe
Token: 34	2592	WMIC.exe
Token: 35	2592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2592	WMIC.exe
Token: SeSecurityPrivilege	2592	WMIC.exe
Token: SeTakeOwnershipPrivilege	2592	WMIC.exe
Token: SeLoadDriverPrivilege	2592	WMIC.exe
Token: SeSystemProfilePrivilege	2592	WMIC.exe
Token: SeSystemtimePrivilege	2592	WMIC.exe
Token: SeProfSingleProcessPrivilege	2592	WMIC.exe
Token: SeIncBasePriorityPrivilege	2592	WMIC.exe
Token: SeCreatePagefilePrivilege	2592	WMIC.exe
Token: SeBackupPrivilege	2592	WMIC.exe
Token: SeRestorePrivilege	2592	WMIC.exe
Token: SeShutdownPrivilege	2592	WMIC.exe
Token: SeDebugPrivilege	2592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2592	WMIC.exe
Token: SeRemoteShutdownPrivilege	2592	WMIC.exe
Token: SeUndockPrivilege	2592	WMIC.exe
Token: SeManageVolumePrivilege	2592	WMIC.exe
Token: 33	2592	WMIC.exe
Token: 34	2592	WMIC.exe
Token: 35	2592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1908	WMIC.exe
Token: SeSecurityPrivilege	1908	WMIC.exe
Token: SeTakeOwnershipPrivilege	1908	WMIC.exe
Token: SeLoadDriverPrivilege	1908	WMIC.exe
Token: SeSystemProfilePrivilege	1908	WMIC.exe
Token: SeSystemtimePrivilege	1908	WMIC.exe
Token: SeProfSingleProcessPrivilege	1908	WMIC.exe
Token: SeIncBasePriorityPrivilege	1908	WMIC.exe
Token: SeCreatePagefilePrivilege	1908	WMIC.exe
Token: SeBackupPrivilege	1908	WMIC.exe
Token: SeRestorePrivilege	1908	WMIC.exe
Token: SeShutdownPrivilege	1908	WMIC.exe
Token: SeDebugPrivilege	1908	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1908	WMIC.exe
Token: SeRemoteShutdownPrivilege	1908	WMIC.exe
Token: SeUndockPrivilege	1908	WMIC.exe
Token: SeManageVolumePrivilege	1908	WMIC.exe
Token: 33	1908	WMIC.exe
Token: 34	1908	WMIC.exe
Token: 35	1908	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1908	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2816	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	33
PID 2472 wrote to memory of 2816	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	33
PID 2472 wrote to memory of 2816	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	33
PID 2472 wrote to memory of 2816	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	33
PID 2816 wrote to memory of 2592	2816	cmd.exe	35
PID 2816 wrote to memory of 2592	2816	cmd.exe	35
PID 2816 wrote to memory of 2592	2816	cmd.exe	35
PID 2472 wrote to memory of 2676	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	36
PID 2472 wrote to memory of 2676	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	36
PID 2472 wrote to memory of 2676	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	36
PID 2472 wrote to memory of 2676	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	36
PID 2676 wrote to memory of 1908	2676	cmd.exe	38
PID 2676 wrote to memory of 1908	2676	cmd.exe	38
PID 2676 wrote to memory of 1908	2676	cmd.exe	38
PID 2472 wrote to memory of 1852	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	39
PID 2472 wrote to memory of 1852	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	39
PID 2472 wrote to memory of 1852	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	39
PID 2472 wrote to memory of 1852	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	39
PID 1852 wrote to memory of 2968	1852	cmd.exe	41
PID 1852 wrote to memory of 2968	1852	cmd.exe	41
PID 1852 wrote to memory of 2968	1852	cmd.exe	41
PID 2472 wrote to memory of 2544	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	42
PID 2472 wrote to memory of 2544	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	42
PID 2472 wrote to memory of 2544	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	42
PID 2472 wrote to memory of 2544	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	42
PID 2544 wrote to memory of 1772	2544	cmd.exe	44
PID 2544 wrote to memory of 1772	2544	cmd.exe	44
PID 2544 wrote to memory of 1772	2544	cmd.exe	44
PID 2472 wrote to memory of 2512	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	45
PID 2472 wrote to memory of 2512	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	45
PID 2472 wrote to memory of 2512	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	45
PID 2472 wrote to memory of 2512	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	45
PID 2512 wrote to memory of 1812	2512	cmd.exe	47
PID 2512 wrote to memory of 1812	2512	cmd.exe	47
PID 2512 wrote to memory of 1812	2512	cmd.exe	47
PID 2472 wrote to memory of 2320	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	48
PID 2472 wrote to memory of 2320	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	48
PID 2472 wrote to memory of 2320	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	48
PID 2472 wrote to memory of 2320	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	48
PID 2320 wrote to memory of 2700	2320	cmd.exe	50
PID 2320 wrote to memory of 2700	2320	cmd.exe	50
PID 2320 wrote to memory of 2700	2320	cmd.exe	50
PID 2472 wrote to memory of 2212	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	51
PID 2472 wrote to memory of 2212	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	51
PID 2472 wrote to memory of 2212	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	51
PID 2472 wrote to memory of 2212	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	51
PID 2212 wrote to memory of 1440	2212	cmd.exe	53
PID 2212 wrote to memory of 1440	2212	cmd.exe	53
PID 2212 wrote to memory of 1440	2212	cmd.exe	53
PID 2472 wrote to memory of 2868	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	54
PID 2472 wrote to memory of 2868	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	54
PID 2472 wrote to memory of 2868	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	54
PID 2472 wrote to memory of 2868	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	54
PID 2868 wrote to memory of 2844	2868	cmd.exe	56
PID 2868 wrote to memory of 2844	2868	cmd.exe	56
PID 2868 wrote to memory of 2844	2868	cmd.exe	56
PID 2472 wrote to memory of 2568	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	57
PID 2472 wrote to memory of 2568	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	57
PID 2472 wrote to memory of 2568	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	57
PID 2472 wrote to memory of 2568	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	57
PID 2568 wrote to memory of 644	2568	cmd.exe	59
PID 2568 wrote to memory of 644	2568	cmd.exe	59
PID 2568 wrote to memory of 644	2568	cmd.exe	59
PID 2472 wrote to memory of 2668	2472	3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe	60

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe
"C:\Users\Admin\AppData\Local\Temp\3dd56e8cb09469eeae1737ce1f7a2414ce7a2d019e685cd80f81e1fea56758ba.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9800B8D-983B-4491-83EB-BC22ED1D7E93}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9800B8D-983B-4491-83EB-BC22ED1D7E93}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0258A7D5-130D-4CEA-8D31-0A38600E987E}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0258A7D5-130D-4CEA-8D31-0A38600E987E}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CBD34A1A-FA88-4E7E-A5A0-7415768215FC}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{CBD34A1A-FA88-4E7E-A5A0-7415768215FC}'" delete
    3⤵
    PID:2968
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F032DFF2-FB08-49DC-99C2-BA1882C8466B}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F032DFF2-FB08-49DC-99C2-BA1882C8466B}'" delete
    3⤵
    PID:1772
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F647B4F-234F-4F59-8149-D5612EB25E04}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F647B4F-234F-4F59-8149-D5612EB25E04}'" delete
    3⤵
    PID:1812
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{814F300D-1DFB-4141-A4B1-F0C7DC24F64C}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{814F300D-1DFB-4141-A4B1-F0C7DC24F64C}'" delete
    3⤵
    PID:2700
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{71352CEE-A1E7-4E76-A2EE-AB294FC63308}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{71352CEE-A1E7-4E76-A2EE-AB294FC63308}'" delete
    3⤵
    PID:1440
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2C78D0B4-0EE8-4DC4-A696-41D961370EDB}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2C78D0B4-0EE8-4DC4-A696-41D961370EDB}'" delete
    3⤵
    PID:2844
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{96473345-74F0-447B-9986-43110DAB7ED6}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{96473345-74F0-447B-9986-43110DAB7ED6}'" delete
    3⤵
    PID:644
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C9837082-6FCE-4E80-AA8D-ECE00C540F2D}'" delete
  2⤵
  PID:2668
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C9837082-6FCE-4E80-AA8D-ECE00C540F2D}'" delete
    3⤵
    PID:680
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{615D6C20-911B-43F1-8086-28A4E25F3116}'" delete
  2⤵
  PID:804
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{615D6C20-911B-43F1-8086-28A4E25F3116}'" delete
    3⤵
    PID:3036
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2ACD8735-6BFA-491F-B9B3-523827A0A950}'" delete
  2⤵
  PID:808
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{2ACD8735-6BFA-491F-B9B3-523827A0A950}'" delete
    3⤵
    PID:1272
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9D827368-593F-47D0-A898-A10D320A44F2}'" delete
  2⤵
  PID:2412
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9D827368-593F-47D0-A898-A10D320A44F2}'" delete
    3⤵
    PID:2136
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{63BA5C73-453B-455D-9F8B-30A376C62F07}'" delete
  2⤵
  PID:2180
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{63BA5C73-453B-455D-9F8B-30A376C62F07}'" delete
    3⤵
    PID:1248
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B19070AF-F105-4C66-8407-2799A5DA875D}'" delete
  2⤵
  PID:2456
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B19070AF-F105-4C66-8407-2799A5DA875D}'" delete
    3⤵
    PID:2368
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B76C57CE-8743-4023-8A0B-EDC2BA9DC6F6}'" delete
  2⤵
  PID:1736
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B76C57CE-8743-4023-8A0B-EDC2BA9DC6F6}'" delete
    3⤵
    PID:976
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F0CB2E9-6400-4596-B4A3-2778D67044BA}'" delete
  2⤵
  PID:2452
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4F0CB2E9-6400-4596-B4A3-2778D67044BA}'" delete
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40113DEC-5436-4294-A9B9-58D2A3592CC4}'" delete
  2⤵
  PID:1340
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40113DEC-5436-4294-A9B9-58D2A3592CC4}'" delete
    3⤵
    PID:1668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\readme.txt

Filesize
1KB

MD5
306b84b6dfba111b3e824d86804998f1

SHA1
7c1cb91fc2b13ca9b6e96407e12e9811a245eab1

SHA256
3d1d151274bffd401a292c2d6a9c165a757d60e9910e0a04b13ab2feb2655854

SHA512
a0313e4a392aeeb17271d007eea708d19e598525f9a78a6c2aa1fb4485ca7b54686c4c0f87b41606729f1d42ee4419f5e25e56aaeddb887fd5f7e57ed200ea0b

Download Submit