Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
268s -
max time network
248s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27/04/2021, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
impolite-oil.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
impolite-oil.exe
-
Size
170KB
-
MD5
dc13d96f8e592de1e29de8a38f4f46dc
-
SHA1
9fb83cf1f940cfdfeeb492fe9f8ec665a2a56aeb
-
SHA256
7c5c340e6ab83c34343b740c9e94612bb1980d773a57b35ca5a4221a4e10215e
-
SHA512
990fe0581a0ec30389a09abd170ec29feff397b06e0c00a91fc0a2111b24b924a631b6779de9c1f9677ad32b54ce578b8bf86a8e011b8ffca2474fe14950e6a5
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\impolite-oil.exe" reg.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02356_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NBOOK_01.MID taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME23.CSS Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105306.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.DPV Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc taskhost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Issues.accdt taskhost.exe File opened for modification C:\Program Files\HideJoin.wax Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dhaka Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18209_.WMF taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Projects.accdt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLCFG32.CPL Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PULLQUOTEBB.DPV taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee100.tlb Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jerusalem taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0171685.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02431_.WMF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293844.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL054.XML Dwm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00736_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21534_.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02413_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01243_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14830_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_K_COL.HXK Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\LATIN1.SHP Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240719.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14795_.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CUPINST.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107300.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\javafx.properties taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00417_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2B.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html Dwm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 28 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1164 vssadmin.exe 70144 vssadmin.exe 70564 vssadmin.exe 70420 vssadmin.exe 70288 vssadmin.exe 70372 vssadmin.exe 70272 vssadmin.exe 70340 vssadmin.exe 70128 vssadmin.exe 70160 vssadmin.exe 70192 vssadmin.exe 70240 vssadmin.exe 70436 vssadmin.exe 70320 vssadmin.exe 70388 vssadmin.exe 70404 vssadmin.exe 70112 vssadmin.exe 70208 vssadmin.exe 69896 vssadmin.exe 70304 vssadmin.exe 70356 vssadmin.exe 70176 vssadmin.exe 70500 vssadmin.exe 70252 vssadmin.exe 70476 vssadmin.exe 70524 vssadmin.exe 70540 vssadmin.exe 70468 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 368 impolite-oil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 368 impolite-oil.exe Token: SeBackupPrivilege 69924 vssvc.exe Token: SeRestorePrivilege 69924 vssvc.exe Token: SeAuditPrivilege 69924 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1128 taskhost.exe 1180 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 368 wrote to memory of 1380 368 impolite-oil.exe 29 PID 368 wrote to memory of 1380 368 impolite-oil.exe 29 PID 368 wrote to memory of 1380 368 impolite-oil.exe 29 PID 368 wrote to memory of 1128 368 impolite-oil.exe 16 PID 1380 wrote to memory of 1236 1380 cmd.exe 31 PID 1380 wrote to memory of 1236 1380 cmd.exe 31 PID 1380 wrote to memory of 1236 1380 cmd.exe 31 PID 368 wrote to memory of 1180 368 impolite-oil.exe 15 PID 1128 wrote to memory of 69860 1128 taskhost.exe 34 PID 1128 wrote to memory of 69860 1128 taskhost.exe 34 PID 1128 wrote to memory of 69860 1128 taskhost.exe 34 PID 69860 wrote to memory of 69896 69860 cmd.exe 36 PID 69860 wrote to memory of 69896 69860 cmd.exe 36 PID 69860 wrote to memory of 69896 69860 cmd.exe 36 PID 69860 wrote to memory of 70112 69860 cmd.exe 40 PID 69860 wrote to memory of 70112 69860 cmd.exe 40 PID 69860 wrote to memory of 70112 69860 cmd.exe 40 PID 69860 wrote to memory of 70144 69860 cmd.exe 41 PID 69860 wrote to memory of 70144 69860 cmd.exe 41 PID 69860 wrote to memory of 70144 69860 cmd.exe 41 PID 69860 wrote to memory of 70176 69860 cmd.exe 42 PID 69860 wrote to memory of 70176 69860 cmd.exe 42 PID 69860 wrote to memory of 70176 69860 cmd.exe 42 PID 69860 wrote to memory of 70208 69860 cmd.exe 43 PID 69860 wrote to memory of 70208 69860 cmd.exe 43 PID 69860 wrote to memory of 70208 69860 cmd.exe 43 PID 69860 wrote to memory of 70240 69860 cmd.exe 44 PID 69860 wrote to memory of 70240 69860 cmd.exe 44 PID 69860 wrote to memory of 70240 69860 cmd.exe 44 PID 69860 wrote to memory of 70272 69860 cmd.exe 45 PID 69860 wrote to memory of 70272 69860 cmd.exe 45 PID 69860 wrote to memory of 70272 69860 cmd.exe 45 PID 69860 wrote to memory of 70304 69860 cmd.exe 46 PID 69860 wrote to memory of 70304 69860 cmd.exe 46 PID 69860 wrote to memory of 70304 69860 cmd.exe 46 PID 69860 wrote to memory of 70340 69860 cmd.exe 47 PID 69860 wrote to memory of 70340 69860 cmd.exe 47 PID 69860 wrote to memory of 70340 69860 cmd.exe 47 PID 69860 wrote to memory of 70372 69860 cmd.exe 48 PID 69860 wrote to memory of 70372 69860 cmd.exe 48 PID 69860 wrote to memory of 70372 69860 cmd.exe 48 PID 69860 wrote to memory of 70404 69860 cmd.exe 49 PID 69860 wrote to memory of 70404 69860 cmd.exe 49 PID 69860 wrote to memory of 70404 69860 cmd.exe 49 PID 69860 wrote to memory of 70436 69860 cmd.exe 50 PID 69860 wrote to memory of 70436 69860 cmd.exe 50 PID 69860 wrote to memory of 70436 69860 cmd.exe 50 PID 69860 wrote to memory of 70468 69860 cmd.exe 51 PID 69860 wrote to memory of 70468 69860 cmd.exe 51 PID 69860 wrote to memory of 70468 69860 cmd.exe 51 PID 69860 wrote to memory of 70500 69860 cmd.exe 52 PID 69860 wrote to memory of 70500 69860 cmd.exe 52 PID 69860 wrote to memory of 70500 69860 cmd.exe 52 PID 1180 wrote to memory of 69908 1180 Dwm.exe 54 PID 1180 wrote to memory of 69908 1180 Dwm.exe 54 PID 1180 wrote to memory of 69908 1180 Dwm.exe 54 PID 69908 wrote to memory of 70128 69908 cmd.exe 56 PID 69908 wrote to memory of 70128 69908 cmd.exe 56 PID 69908 wrote to memory of 70128 69908 cmd.exe 56 PID 69908 wrote to memory of 70160 69908 cmd.exe 57 PID 69908 wrote to memory of 70160 69908 cmd.exe 57 PID 69908 wrote to memory of 70160 69908 cmd.exe 57 PID 69908 wrote to memory of 70192 69908 cmd.exe 58 PID 69908 wrote to memory of 70192 69908 cmd.exe 58
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69908 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70128
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70160
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70192
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70252
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70288
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70320
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70356
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70388
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70420
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70476
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70524
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70540
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1164
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70564
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69860 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69896
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70112
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70144
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70176
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70208
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70240
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70272
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70304
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70340
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70372
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70404
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70436
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70468
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70500
-
-
-
C:\Users\Admin\AppData\Local\Temp\impolite-oil.exe"C:\Users\Admin\AppData\Local\Temp\impolite-oil.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\impolite-oil.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\impolite-oil.exe" /f3⤵
- Adds Run key to start application
PID:1236
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69924
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:70236