Analysis
-
max time kernel
273s -
max time network
158s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
modern-class.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
modern-class.exe
-
Size
170KB
-
MD5
94bdd553466b36524bb9308b245ed645
-
SHA1
0eedde5d39856a5f41cafff0fffbd37ec47e00b0
-
SHA256
8f31faebc04f2628683badd2054e5ea94194900b2316fb783e2bc7ab566fa9b7
-
SHA512
9563cf2fb0ea0b37b870179e45e4a82671e741dd8d6bdb38b53cff1481f4f4a88acde797ea645dc01cc82cb11f30d70d90d6486e60c2f15c4cd7ae4c1a80c892
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\modern-class.exe" reg.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01196_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\AXIS.INF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00272_.WMF taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FORM.JS Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Newsprint.thmx taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15018_.GIF taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00155_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR16F.GIF Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02756U.BMP taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DOTS.POC taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Chita taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Moncton taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_COL.HXT taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.HXS taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\TIME.XML taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185828.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.LEX taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FOLDPROJ.XML taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0230876.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SPACE_01.MID taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Composite.eftx taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FLYER.XML taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234001.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue taskhost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0230553.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32F.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN081.XML taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif Dwm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 28 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1880 vssadmin.exe 1684 vssadmin.exe 1172 vssadmin.exe 1544 vssadmin.exe 69660 vssadmin.exe 69976 vssadmin.exe 1728 vssadmin.exe 69908 vssadmin.exe 70152 vssadmin.exe 69844 vssadmin.exe 69944 vssadmin.exe 69628 vssadmin.exe 360 vssadmin.exe 2084 vssadmin.exe 69732 vssadmin.exe 1644 vssadmin.exe 2052 vssadmin.exe 70056 vssadmin.exe 70100 vssadmin.exe 69780 vssadmin.exe 69876 vssadmin.exe 568 vssadmin.exe 1300 vssadmin.exe 1928 vssadmin.exe 1636 vssadmin.exe 69692 vssadmin.exe 69812 vssadmin.exe 70008 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1096 modern-class.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1096 modern-class.exe Token: SeBackupPrivilege 69612 vssvc.exe Token: SeRestorePrivilege 69612 vssvc.exe Token: SeAuditPrivilege 69612 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1120 taskhost.exe 1176 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1404 1096 modern-class.exe 29 PID 1096 wrote to memory of 1404 1096 modern-class.exe 29 PID 1096 wrote to memory of 1404 1096 modern-class.exe 29 PID 1096 wrote to memory of 1120 1096 modern-class.exe 13 PID 1096 wrote to memory of 1176 1096 modern-class.exe 12 PID 1096 wrote to memory of 1404 1096 modern-class.exe 29 PID 1404 wrote to memory of 1568 1404 cmd.exe 31 PID 1404 wrote to memory of 1568 1404 cmd.exe 31 PID 1404 wrote to memory of 1568 1404 cmd.exe 31 PID 1120 wrote to memory of 33780 1120 taskhost.exe 34 PID 1120 wrote to memory of 33780 1120 taskhost.exe 34 PID 1120 wrote to memory of 33780 1120 taskhost.exe 34 PID 33780 wrote to memory of 69628 33780 cmd.exe 36 PID 33780 wrote to memory of 69628 33780 cmd.exe 36 PID 33780 wrote to memory of 69628 33780 cmd.exe 36 PID 33780 wrote to memory of 1728 33780 cmd.exe 39 PID 33780 wrote to memory of 1728 33780 cmd.exe 39 PID 33780 wrote to memory of 1728 33780 cmd.exe 39 PID 33780 wrote to memory of 568 33780 cmd.exe 40 PID 33780 wrote to memory of 568 33780 cmd.exe 40 PID 33780 wrote to memory of 568 33780 cmd.exe 40 PID 33780 wrote to memory of 360 33780 cmd.exe 41 PID 33780 wrote to memory of 360 33780 cmd.exe 41 PID 33780 wrote to memory of 360 33780 cmd.exe 41 PID 33780 wrote to memory of 1880 33780 cmd.exe 42 PID 33780 wrote to memory of 1880 33780 cmd.exe 42 PID 33780 wrote to memory of 1880 33780 cmd.exe 42 PID 33780 wrote to memory of 1684 33780 cmd.exe 43 PID 33780 wrote to memory of 1684 33780 cmd.exe 43 PID 33780 wrote to memory of 1684 33780 cmd.exe 43 PID 33780 wrote to memory of 1172 33780 cmd.exe 44 PID 33780 wrote to memory of 1172 33780 cmd.exe 44 PID 33780 wrote to memory of 1172 33780 cmd.exe 44 PID 33780 wrote to memory of 1636 33780 cmd.exe 45 PID 33780 wrote to memory of 1636 33780 cmd.exe 45 PID 33780 wrote to memory of 1636 33780 cmd.exe 45 PID 33780 wrote to memory of 1300 33780 cmd.exe 46 PID 33780 wrote to memory of 1300 33780 cmd.exe 46 PID 33780 wrote to memory of 1300 33780 cmd.exe 46 PID 33780 wrote to memory of 1928 33780 cmd.exe 47 PID 33780 wrote to memory of 1928 33780 cmd.exe 47 PID 33780 wrote to memory of 1928 33780 cmd.exe 47 PID 33780 wrote to memory of 1644 33780 cmd.exe 48 PID 33780 wrote to memory of 1644 33780 cmd.exe 48 PID 33780 wrote to memory of 1644 33780 cmd.exe 48 PID 33780 wrote to memory of 1544 33780 cmd.exe 49 PID 33780 wrote to memory of 1544 33780 cmd.exe 49 PID 33780 wrote to memory of 1544 33780 cmd.exe 49 PID 33780 wrote to memory of 2052 33780 cmd.exe 50 PID 33780 wrote to memory of 2052 33780 cmd.exe 50 PID 33780 wrote to memory of 2052 33780 cmd.exe 50 PID 33780 wrote to memory of 2084 33780 cmd.exe 51 PID 33780 wrote to memory of 2084 33780 cmd.exe 51 PID 33780 wrote to memory of 2084 33780 cmd.exe 51 PID 1176 wrote to memory of 53944 1176 Dwm.exe 53 PID 1176 wrote to memory of 53944 1176 Dwm.exe 53 PID 1176 wrote to memory of 53944 1176 Dwm.exe 53 PID 53944 wrote to memory of 69660 53944 cmd.exe 55 PID 53944 wrote to memory of 69660 53944 cmd.exe 55 PID 53944 wrote to memory of 69660 53944 cmd.exe 55 PID 53944 wrote to memory of 69692 53944 cmd.exe 56 PID 53944 wrote to memory of 69692 53944 cmd.exe 56 PID 53944 wrote to memory of 69692 53944 cmd.exe 56 PID 53944 wrote to memory of 69732 53944 cmd.exe 57
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:53944 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69660
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:69692
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:69732
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69780
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69812
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69844
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69876
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69908
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69944
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69976
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70008
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70056
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70100
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70152
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:33780 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69628
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:1728
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:568
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:360
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1880
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1684
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1172
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1636
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1300
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1928
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1644
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1544
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:2052
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2084
-
-
-
C:\Users\Admin\AppData\Local\Temp\modern-class.exe"C:\Users\Admin\AppData\Local\Temp\modern-class.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\modern-class.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\modern-class.exe" /f3⤵
- Adds Run key to start application
PID:1568
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69612
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:69720