Analysis
-
max time kernel
272s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
piquant-climate.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
piquant-climate.exe
-
Size
170KB
-
MD5
e2ec6bde7b404d9143fecefa56832795
-
SHA1
31cb26f3260d403dd2d13e26686ea4c1df24b338
-
SHA256
759301b4ca1180d3cff0280e2fa73de60b8650dea28bd6c0fa20a1216b910077
-
SHA512
95ef312d54ba600836286531e9efaa3fad1cea8516f4295f1fa4557414baa5f706b59f59b9637267d13ffdcaa422158b8294704e5ee4fda3269c356211b9a3d7
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\piquant-climate.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\⌡╫öQ cmd.exe File created C:\Windows\System32\Me66 cmd.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OutDomain.ico taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\JNGLE_01.MID taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGLINACC.XML Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5 taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.core_3.5.0.v20120725-1805.jar Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00319_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02268_.WMF Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg Dwm.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt Dwm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CNFRES.CFG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21295_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\MedianFax.Dotx Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\RMNSQUE.ELM Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222021.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14833_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4B.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\ROGERS.COM.XML Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287415.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME35.CSS taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LTHD11.POC Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10 taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00057_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME50.CSS taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188587.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21338_.GIF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03041I.JPG taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00018_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03143I.JPG taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02252_.WMF Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKL.ICO taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Module.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG Dwm.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg taskhost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.jpg taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\AMERITECH.NET.XML taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\vocaroo.luac Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL097.XML Dwm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 28 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 69760 vssadmin.exe 69812 vssadmin.exe 11412 vssadmin.exe 16180 vssadmin.exe 30852 vssadmin.exe 18696 vssadmin.exe 236 vssadmin.exe 70148 vssadmin.exe 14444 vssadmin.exe 33016 vssadmin.exe 70048 vssadmin.exe 24324 vssadmin.exe 70356 vssadmin.exe 69740 vssadmin.exe 9392 vssadmin.exe 28420 vssadmin.exe 30868 vssadmin.exe 69548 vssadmin.exe 15552 vssadmin.exe 21700 vssadmin.exe 69516 vssadmin.exe 9072 vssadmin.exe 11376 vssadmin.exe 18068 vssadmin.exe 69840 vssadmin.exe 69944 vssadmin.exe 296 vssadmin.exe 4804 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 748 piquant-climate.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 748 piquant-climate.exe Token: SeBackupPrivilege 69636 vssvc.exe Token: SeRestorePrivilege 69636 vssvc.exe Token: SeAuditPrivilege 69636 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1128 taskhost.exe 1212 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 748 wrote to memory of 1308 748 piquant-climate.exe 29 PID 748 wrote to memory of 1308 748 piquant-climate.exe 29 PID 748 wrote to memory of 1308 748 piquant-climate.exe 29 PID 748 wrote to memory of 1128 748 piquant-climate.exe 13 PID 1308 wrote to memory of 1488 1308 cmd.exe 31 PID 1308 wrote to memory of 1488 1308 cmd.exe 31 PID 1308 wrote to memory of 1488 1308 cmd.exe 31 PID 748 wrote to memory of 1212 748 piquant-climate.exe 12 PID 1128 wrote to memory of 69596 1128 taskhost.exe 33 PID 1128 wrote to memory of 69596 1128 taskhost.exe 33 PID 1128 wrote to memory of 69596 1128 taskhost.exe 33 PID 69596 wrote to memory of 296 69596 cmd.exe 35 PID 69596 wrote to memory of 296 69596 cmd.exe 35 PID 69596 wrote to memory of 296 69596 cmd.exe 35 PID 69596 wrote to memory of 4804 69596 cmd.exe 39 PID 69596 wrote to memory of 4804 69596 cmd.exe 39 PID 69596 wrote to memory of 4804 69596 cmd.exe 39 PID 69596 wrote to memory of 9072 69596 cmd.exe 40 PID 69596 wrote to memory of 9072 69596 cmd.exe 40 PID 69596 wrote to memory of 9072 69596 cmd.exe 40 PID 69596 wrote to memory of 11376 69596 cmd.exe 41 PID 69596 wrote to memory of 11376 69596 cmd.exe 41 PID 69596 wrote to memory of 11376 69596 cmd.exe 41 PID 69596 wrote to memory of 14444 69596 cmd.exe 42 PID 69596 wrote to memory of 14444 69596 cmd.exe 42 PID 69596 wrote to memory of 14444 69596 cmd.exe 42 PID 69596 wrote to memory of 16180 69596 cmd.exe 43 PID 69596 wrote to memory of 16180 69596 cmd.exe 43 PID 69596 wrote to memory of 16180 69596 cmd.exe 43 PID 69596 wrote to memory of 18068 69596 cmd.exe 44 PID 69596 wrote to memory of 18068 69596 cmd.exe 44 PID 69596 wrote to memory of 18068 69596 cmd.exe 44 PID 69596 wrote to memory of 18696 69596 cmd.exe 45 PID 69596 wrote to memory of 18696 69596 cmd.exe 45 PID 69596 wrote to memory of 18696 69596 cmd.exe 45 PID 69596 wrote to memory of 21700 69596 cmd.exe 46 PID 69596 wrote to memory of 21700 69596 cmd.exe 46 PID 69596 wrote to memory of 21700 69596 cmd.exe 46 PID 69596 wrote to memory of 24324 69596 cmd.exe 47 PID 69596 wrote to memory of 24324 69596 cmd.exe 47 PID 69596 wrote to memory of 24324 69596 cmd.exe 47 PID 69596 wrote to memory of 28420 69596 cmd.exe 48 PID 69596 wrote to memory of 28420 69596 cmd.exe 48 PID 69596 wrote to memory of 28420 69596 cmd.exe 48 PID 69596 wrote to memory of 30852 69596 cmd.exe 49 PID 69596 wrote to memory of 30852 69596 cmd.exe 49 PID 69596 wrote to memory of 30852 69596 cmd.exe 49 PID 69596 wrote to memory of 30868 69596 cmd.exe 50 PID 69596 wrote to memory of 30868 69596 cmd.exe 50 PID 69596 wrote to memory of 30868 69596 cmd.exe 50 PID 69596 wrote to memory of 33016 69596 cmd.exe 51 PID 69596 wrote to memory of 33016 69596 cmd.exe 51 PID 69596 wrote to memory of 33016 69596 cmd.exe 51 PID 1212 wrote to memory of 69540 1212 Dwm.exe 53 PID 1212 wrote to memory of 69540 1212 Dwm.exe 53 PID 1212 wrote to memory of 69540 1212 Dwm.exe 53 PID 69540 wrote to memory of 69516 69540 cmd.exe 55 PID 69540 wrote to memory of 69516 69540 cmd.exe 55 PID 69540 wrote to memory of 69516 69540 cmd.exe 55 PID 69540 wrote to memory of 69548 69540 cmd.exe 56 PID 69540 wrote to memory of 69548 69540 cmd.exe 56 PID 69540 wrote to memory of 69548 69540 cmd.exe 56 PID 69540 wrote to memory of 69760 69540 cmd.exe 58 PID 69540 wrote to memory of 69760 69540 cmd.exe 58
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69540 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69516
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:69548
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:69760
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69812
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69840
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69944
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70048
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70148
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70356
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:236
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:15552
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69740
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:9392
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:11412
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:69596 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:296
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:4804
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:9072
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:11376
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:14444
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:16180
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:18068
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:18696
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:21700
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:24324
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:28420
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:30852
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:30868
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:33016
-
-
-
C:\Users\Admin\AppData\Local\Temp\piquant-climate.exe"C:\Users\Admin\AppData\Local\Temp\piquant-climate.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\piquant-climate.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\piquant-climate.exe" /f3⤵
- Adds Run key to start application
PID:1488
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69636
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:69748