Overview
overview
10Static
static
100486218577...d9.exe
windows7-x64
109bfd15145...11.exe
windows7-x64
9141d93e2d4...aa.exe
windows7-x64
1016c2807567...55.exe
windows7-x64
32f41c73046...95.exe
windows7-x64
103e275093a5...01.exe
windows7-x64
10419a809f42...89.exe
windows7-x64
34b10fd0d5e...58.exe
windows7-x64
104d78c439ed...f7.exe
windows7-x64
74f7713dcf8...63.exe
windows7-x64
7597deecbe6...4d.exe
windows7-x64
76b59edf464...e8.exe
windows7-x64
87def3cd43d...d8.exe
windows7-x64
796ba85326e...8a.exe
windows7-x64
797f1b6afb2...2e.exe
windows7-x64
59906747639...1e.exe
windows7-x64
19e1609ab7f...08.exe
windows7-x64
10b7fc91fc1f...37.exe
windows7-x64
7bf179bbd2c...25.exe
windows7-x64
3cfc68c40f4...4f.exe
windows7-x64
6e6e948a0aa...eb.exe
windows7-x64
1f02fe52119...68.exe
windows7-x64
8$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows7-x64
3secrehosted.exe
windows7-x64
3Analysis
- max time kernel
122s - max time network
124s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
27/11/2024, 09:28
Behavioral task
behavioral1
Sample
04862185775476ae0b6f7e8a02133cb408d212ca17bbff5c20dcfdcf569b3dd9.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
141d93e2d408738bba4f523f60d6ead702424e7d62c34921c8a34150a31870aa.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
16c2807567b31c30288d92c0649ce78ea87434104bac72db407bb45bf65a4855.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
2f41c73046f3b0f5edd79ae089b6b64ec3a0812ea02fe7325b8e5b171a621c95.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
3e275093a5ad4b2083eda47dfd2e9053cae044f7990a323c6f649093a8d00901.exe
Resource
win7-20240903-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral7
Sample
419a809f42361b2fcff98eb6f201e54ecef532c9b378db06e999f54285032889.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
4b10fd0d5e4370dde456862f810e27b2be1f854356191b9893ab1a65f4af5358.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral9
Sample
4d78c439ed8860a14aebcf79dfef27047a51fc36c514b40b48724cd9340ff6f7.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
4f7713dcf8ad6717ea6eb432774a29317649a512445221dc0a29ed79e48b7663.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral11
Sample
597deecbe673c67d998825bdf4ddeca83f6fbb3bdccec91dabf4f9052713ac4d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
6b59edf464eaaeac4f4b2f43474e573694429f08c448db770618dc574b6171e8.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
7def3cd43d98a30a04f09be284cab8b8dbf96ecc2e78302f6c45ad524c41d7d8.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
96ba85326e2250f4e1cf07f5981bb96ea1383901663a6354899b5da0cd77b98a.exe
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
97f1b6afb24cda22203275fc34bd07ba51170729edba8ee67bdb66a529574a2e.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
9906747639b782d738555a2522acd4a09ca8a3356f7848a4e68f284d888d891e.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral18
Sample
b7fc91fc1fa6a53b1e5d97e21a7abefbde3ca7349d4db0fdbe15ec2702b1b737.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
bf179bbd2ce7ca31e421334efa7d262e30dc16b9bb5cced1b8b18d119adc4425.exe
Resource
win7-20241010-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
cfc68c40f4631954894898633fd0c5a06c5ce5837eba7d4b56fc3514c01e124f.exe
Resource
win7-20241023-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral21
Sample
e6e948a0aa3605bbd636ccdfa56e771dfebafa1e150d84f96b1968f8803edbeb.exe
Resource
win7-20240729-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
f02fe52119ff47fed2e52b28ec2c42a8eae8233b4c588c310dbaef3297b5d768.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
secrehosted.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
General
- Target 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe
- Size 765KB
- Sample241127-lfrx3atrgr
- SHA256 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11
- MD5 500ef53924b722ddb43632b0dd9070c9
- SHA1 daf44813ae7f0792ccb3640cd4c700193daf6cf4
- SHA512 f7ace2a8e018ef576e98221b60ac9e99477b2e5ef7f323147c9f90c3f9a1639cd778eca4558491a2c4217001d52377fa8ec5ac2732ee362221c34c69c7610216
- SSDEEP 12288:Xl26S0vAcB+UwoVSidDHeeIJoCnVRWJvdKLv8S2cZtWkHCmTBQk9TfXX4Jy0Ro0Y:VlS2jgvkTee8VRWJVKLvR2cbWaHTPXqy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3024) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Deletes itself 1 IoCs
pid Process 2388 conhost.exe - Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini conhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.exe conhost.exe - Executes dropped EXE 1 IoCs
pid Process 2388 conhost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\conhost.exe" 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe - Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GUJ7UW2N\desktop.ini conhost.exe File opened for modification C:\Program Files\desktop.ini conhost.exe File opened for modification C:\Users\Public\Videos\desktop.ini conhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\3W44XPEP\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8O71085\desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini conhost.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Links\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini conhost.exe File opened for modification C:\Users\Public\Downloads\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini conhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini conhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini conhost.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini conhost.exe File opened for modification C:\Users\Admin\Music\desktop.ini conhost.exe File opened for modification C:\Users\Public\Documents\desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GKATPXW1\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini conhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\75GKCLJR\desktop.ini conhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini conhost.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GFIGH6G\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini conhost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini conhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini conhost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini conhost.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini conhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini conhost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini conhost.exe File opened for modification C:\Program Files (x86)\desktop.ini conhost.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini conhost.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini conhost.exe File opened for modification C:\Users\Public\Music\desktop.ini conhost.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini conhost.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini conhost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini conhost.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini conhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini conhost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryResume.dotx.exe conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.exe conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml.exe conhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml conhost.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml.exe conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.exe conhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar conhost.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\arrow.png.exe conhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\JavaAccessBridge-64.dll.exe conhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg conhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.exe conhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar conhost.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll conhost.exe File created C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.exe conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.exe conhost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.exe conhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll conhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar.exe conhost.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.exe conhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png conhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down.png conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.exe conhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\gradient.png conhost.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\gadget.xml conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png conhost.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll conhost.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\Shvl.dll.exe conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_rainy.png conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\settings.js conhost.exe File opened for modification C:\Program Files (x86)\Common Files\System\DirectDB.dll conhost.exe File opened for modification C:\Program Files\Java\jre7\bin\JdbcOdbc.dll conhost.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml.exe conhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_ja_4.4.0.v20140623020002.jar.exe conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar conhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll conhost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif conhost.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll conhost.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg.exe conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png conhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png conhost.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.exe conhost.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\common.js.exe conhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\picturePuzzle.js conhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Response.gif conhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv conhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar conhost.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.exe conhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png conhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down_BIDI.png conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt conhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar conhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2388 conhost.exe 2388 conhost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2388 conhost.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2388 conhost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1556 wrote to memory of 2388 1556 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe 30 PID 1556 wrote to memory of 2388 1556 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe 30 PID 1556 wrote to memory of 2388 1556 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe"C:\Users\Admin\AppData\Local\Temp\09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Adobe\Acrobat\11.0\Cache\conhost.exe"C:\Users\Admin\AppData\Local\Adobe\Acrobat\11.0\Cache\conhost.exe" C:\Users\Admin\AppData\Local\Temp\09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11.exe2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.exe
- Size 809KB
- SHA256 cab706180bc0fa8c74b62fc4b0b1c01da3d3d3ab1b44212774911a050a2ec422
- MD5 80c8b0e36ef420a1a816c37f882ac33c
- SHA1 e63c8db1653747a545de22550cfadf5e11396cc7
- SHA512 ee8571aec61022d6c55e9ab14fc9e0cb8906832671ae3ebf1346b7b18fa53586e9834ffa947f0c0404d1ba5174c4895599730e49b82fbe1e85962eed78f474bd
- SSDEEP 24576:twudRIoaq3/LNlxIQi2GAKGajWWUX94gRN:nB/jxIQCnWr2K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.exe
- Size 160B
- SHA256 65d261cda5e626a51ddebc95cef46cc89d70bbc6788eecd30ea6ed9ed57f0c09
- MD5 b8658f1969749bf10f92d766534f9e57
- SHA1 a0ca1615014c54ce64a3e663e64b4b4dbdc3e73c
- SHA512 27540cd85d0795b9e6b7786ff62d16587c2ffec1c8ef49f50d473fbf5306d3ec8162758592341c400570df93e38e93ec1ddf5e42851de680b9f327956e4b725c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\11.0\Cache\conhost.exe
- Size 765KB
- SHA256 09bfd15145c9d8e39f99d3dfe98337a8c488dc334dfe195d27bdeb5b2459fd11
- MD5 500ef53924b722ddb43632b0dd9070c9
- SHA1 daf44813ae7f0792ccb3640cd4c700193daf6cf4
- SHA512 f7ace2a8e018ef576e98221b60ac9e99477b2e5ef7f323147c9f90c3f9a1639cd778eca4558491a2c4217001d52377fa8ec5ac2732ee362221c34c69c7610216
- SSDEEP 12288:Xl26S0vAcB+UwoVSidDHeeIJoCnVRWJvdKLv8S2cZtWkHCmTBQk9TfXX4Jy0Ro0Y:VlS2jgvkTee8VRWJVKLvR2cbWaHTPXqy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\L7XNHY48\desktop.ini.exe
- Size 80B
- SHA256 54e61521e019af817c792629b05f59a8a0bea2dc1c46c479f084b10aaa131c03
- MD5 fd4e88571fbaf0ccecdc4123f8be390e
- SHA1 09c3309f91041bae389ce66145ffd8f1a7ab4f43
- SHA512 4c04872371ec8254a93c128e2eb287bd1a8670ebddf3902fe87e658a0c85e8c1dee6b79dc1afe6d5cd2b19442664b6f8087fc3821a18bc58c377593976000d14
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\container.dat.exe
- Size 16B
- SHA256 489f323b35b1be9f94e4d81ea799073fbc4fd8a1a6cd4623fc42c2d4d2555e76
- MD5 27dffbdb5818d4b8680c5d22680dd1c9
- SHA1 78b83c5951f973fd85e7cc22adf1a549de0348f0
- SHA512 dff968a9e309367278464273a7d94ff71fde955204e3f8776ed5159344593f0aad57eb22e3b91ff4a6db33cf0d8e085bdf613099696784efc03d8b5474b1bc05
- MD5 SHA1 SHA512