Analysis
-
max time kernel
201s -
max time network
34s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
present-evidence.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
present-evidence.exe
-
Size
170KB
-
MD5
f8b4e1f992524d675052d26e1a464803
-
SHA1
771d3a140959a1c1890351a842fe8c63e4da6eb7
-
SHA256
efbdbacda5b2b84165f3d4a5a974f98032b3f0dd2733188e079cda131671bde5
-
SHA512
ea80225dac886a7543ee49d0fb2c4ada057ae489f18da02653a1978808e2501e64e558a0dab9b3dd0512dfbff7180d2749632763a84d17e933d73dd2975aa04e
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\present-evidence.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\PREVIEW.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10265_.GIF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_zh_4.4.0.v20140623020002.jar Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Oriel.thmx Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00426_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_italic.gif taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvm.jar taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18197_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif taskhost.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsource.ax Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00512_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_on.gif Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099193.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172035.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143753.GIF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02388_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00121_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00416_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.TH.XML Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qatar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Fortaleza Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\STRTEDGE.INF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01840_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\utilityfunctions.js Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.OPG taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235319.WMF taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188669.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00395_.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01304G.GIF taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 28 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 44568 vssadmin.exe 1216 vssadmin.exe 69600 vssadmin.exe 70304 vssadmin.exe 70440 vssadmin.exe 70536 vssadmin.exe 70652 vssadmin.exe 69824 vssadmin.exe 69816 vssadmin.exe 70492 vssadmin.exe 70572 vssadmin.exe 70640 vssadmin.exe 69956 vssadmin.exe 70292 vssadmin.exe 70368 vssadmin.exe 70084 vssadmin.exe 70144 vssadmin.exe 70196 vssadmin.exe 70416 vssadmin.exe 70128 vssadmin.exe 70356 vssadmin.exe 70484 vssadmin.exe 70588 vssadmin.exe 70032 vssadmin.exe 70052 vssadmin.exe 70208 vssadmin.exe 70256 vssadmin.exe 70000 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1668 present-evidence.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1668 present-evidence.exe Token: SeBackupPrivilege 69628 vssvc.exe Token: SeRestorePrivilege 69628 vssvc.exe Token: SeAuditPrivilege 69628 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1116 taskhost.exe 1176 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2024 1668 present-evidence.exe 26 PID 1668 wrote to memory of 2024 1668 present-evidence.exe 26 PID 1668 wrote to memory of 2024 1668 present-evidence.exe 26 PID 1668 wrote to memory of 1116 1668 present-evidence.exe 14 PID 2024 wrote to memory of 1208 2024 cmd.exe 28 PID 2024 wrote to memory of 1208 2024 cmd.exe 28 PID 2024 wrote to memory of 1208 2024 cmd.exe 28 PID 1668 wrote to memory of 1176 1668 present-evidence.exe 13 PID 1116 wrote to memory of 69564 1116 taskhost.exe 34 PID 1116 wrote to memory of 69564 1116 taskhost.exe 34 PID 1116 wrote to memory of 69564 1116 taskhost.exe 34 PID 69564 wrote to memory of 69600 69564 cmd.exe 36 PID 69564 wrote to memory of 69600 69564 cmd.exe 36 PID 69564 wrote to memory of 69600 69564 cmd.exe 36 PID 1176 wrote to memory of 69772 1176 Dwm.exe 41 PID 1176 wrote to memory of 69772 1176 Dwm.exe 41 PID 1176 wrote to memory of 69772 1176 Dwm.exe 41 PID 69772 wrote to memory of 69816 69772 cmd.exe 43 PID 69772 wrote to memory of 69816 69772 cmd.exe 43 PID 69772 wrote to memory of 69816 69772 cmd.exe 43 PID 69772 wrote to memory of 69956 69772 cmd.exe 46 PID 69772 wrote to memory of 69956 69772 cmd.exe 46 PID 69772 wrote to memory of 69956 69772 cmd.exe 46 PID 69772 wrote to memory of 70000 69772 cmd.exe 47 PID 69772 wrote to memory of 70000 69772 cmd.exe 47 PID 69772 wrote to memory of 70000 69772 cmd.exe 47 PID 69564 wrote to memory of 70032 69564 cmd.exe 48 PID 69564 wrote to memory of 70032 69564 cmd.exe 48 PID 69564 wrote to memory of 70032 69564 cmd.exe 48 PID 69772 wrote to memory of 70052 69772 cmd.exe 49 PID 69772 wrote to memory of 70052 69772 cmd.exe 49 PID 69772 wrote to memory of 70052 69772 cmd.exe 49 PID 69564 wrote to memory of 70084 69564 cmd.exe 50 PID 69564 wrote to memory of 70084 69564 cmd.exe 50 PID 69564 wrote to memory of 70084 69564 cmd.exe 50 PID 69564 wrote to memory of 70128 69564 cmd.exe 51 PID 69564 wrote to memory of 70128 69564 cmd.exe 51 PID 69564 wrote to memory of 70128 69564 cmd.exe 51 PID 69772 wrote to memory of 70144 69772 cmd.exe 52 PID 69772 wrote to memory of 70144 69772 cmd.exe 52 PID 69772 wrote to memory of 70144 69772 cmd.exe 52 PID 69564 wrote to memory of 70196 69564 cmd.exe 53 PID 69564 wrote to memory of 70196 69564 cmd.exe 53 PID 69564 wrote to memory of 70196 69564 cmd.exe 53 PID 69772 wrote to memory of 70208 69772 cmd.exe 54 PID 69772 wrote to memory of 70208 69772 cmd.exe 54 PID 69772 wrote to memory of 70208 69772 cmd.exe 54 PID 69772 wrote to memory of 70256 69772 cmd.exe 55 PID 69772 wrote to memory of 70256 69772 cmd.exe 55 PID 69772 wrote to memory of 70256 69772 cmd.exe 55 PID 69772 wrote to memory of 70292 69772 cmd.exe 56 PID 69772 wrote to memory of 70292 69772 cmd.exe 56 PID 69772 wrote to memory of 70292 69772 cmd.exe 56 PID 69564 wrote to memory of 70304 69564 cmd.exe 57 PID 69564 wrote to memory of 70304 69564 cmd.exe 57 PID 69564 wrote to memory of 70304 69564 cmd.exe 57 PID 69772 wrote to memory of 70356 69772 cmd.exe 59 PID 69772 wrote to memory of 70356 69772 cmd.exe 59 PID 69772 wrote to memory of 70356 69772 cmd.exe 59 PID 69564 wrote to memory of 70368 69564 cmd.exe 58 PID 69564 wrote to memory of 70368 69564 cmd.exe 58 PID 69564 wrote to memory of 70368 69564 cmd.exe 58 PID 69564 wrote to memory of 70416 69564 cmd.exe 60 PID 69564 wrote to memory of 70416 69564 cmd.exe 60
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69772 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69816
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:69956
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70000
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70052
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70144
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70208
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70256
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70292
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70356
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70440
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70492
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70572
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70640
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:44568
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69564 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69600
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70032
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70084
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70128
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70196
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70304
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70368
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70416
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70484
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70536
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70588
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70652
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69824
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1216
-
-
-
C:\Users\Admin\AppData\Local\Temp\present-evidence.exe"C:\Users\Admin\AppData\Local\Temp\present-evidence.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\present-evidence.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\present-evidence.exe" /f3⤵
- Adds Run key to start application
PID:1208
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69628
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:69920