Analysis
-
max time kernel
190s -
max time network
81s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
unique-membership.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
unique-membership.exe
-
Size
170KB
-
MD5
d36a375376e0ad03a104c0230aadf9cc
-
SHA1
0cf56afc7d75379bce091e30f575a7ef6aeddc3b
-
SHA256
74362795d3137d99903e1afe062754b1e3f7c5600c54ad5c1ccd76a1f2978ddc
-
SHA512
184888270df2a3909b6734f5db5cbca9c42cfca068cf2d19f10c158054a05f7bb4fadd4c698f1047482e113df47e83572d9eb83456a78a70d9c86a23ac2ccb9b
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConvertUninstall.tiff taskhost.exe File opened for modification C:\Users\Admin\Pictures\ConvertUninstall.tiff vssadmin.exe File opened for modification C:\Users\Admin\Pictures\ConvertUninstall.tiff Dwm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\unique-membership.exe" reg.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Document.gif taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MYSL.ICO taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Verve.eftx taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287645.JPG Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SIGN.CFG Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BOMB.WAV vssadmin.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.BR.XML Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0324704.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\EquityFax.Dotx vssadmin.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099146.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0221903.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png Dwm.exe File opened for modification C:\Program Files\Java\jre7\COPYRIGHT taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14791_.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN109.XML vssadmin.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ODBCR.SAM Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MARQUEE.POC vssadmin.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02097_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107708.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02950_.WMF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.log Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\OliveGreen.css taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Top.accdt Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Niue taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6B.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR20F.GIF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00395_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00559_.WMF Dwm.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGDIC.DAT taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157167.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00505_.WMF Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 28 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 70144 vssadmin.exe 70236 vssadmin.exe 220 vssadmin.exe 69940 vssadmin.exe 70040 vssadmin.exe 70172 vssadmin.exe 69916 vssadmin.exe 69700 vssadmin.exe 69972 vssadmin.exe 69956 vssadmin.exe 70056 vssadmin.exe 70076 vssadmin.exe 70108 vssadmin.exe 69716 vssadmin.exe 69988 vssadmin.exe 70268 vssadmin.exe 1116 vssadmin.exe 70020 vssadmin.exe 70088 vssadmin.exe 70216 vssadmin.exe 70204 vssadmin.exe 70332 vssadmin.exe 70184 vssadmin.exe 70240 vssadmin.exe 70140 vssadmin.exe 70120 vssadmin.exe 70008 vssadmin.exe 70300 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1652 unique-membership.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1652 unique-membership.exe Token: SeBackupPrivilege 69732 vssvc.exe Token: SeRestorePrivilege 69732 vssvc.exe Token: SeAuditPrivilege 69732 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1116 vssadmin.exe 1168 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1968 1652 unique-membership.exe 26 PID 1652 wrote to memory of 1968 1652 unique-membership.exe 26 PID 1652 wrote to memory of 1968 1652 unique-membership.exe 26 PID 1652 wrote to memory of 1116 1652 unique-membership.exe 16 PID 1652 wrote to memory of 1168 1652 unique-membership.exe 15 PID 1652 wrote to memory of 1968 1652 unique-membership.exe 26 PID 1968 wrote to memory of 1028 1968 cmd.exe 28 PID 1968 wrote to memory of 1028 1968 cmd.exe 28 PID 1968 wrote to memory of 1028 1968 cmd.exe 28 PID 1116 wrote to memory of 69664 1116 vssadmin.exe 33 PID 1116 wrote to memory of 69664 1116 vssadmin.exe 33 PID 1116 wrote to memory of 69664 1116 vssadmin.exe 33 PID 69664 wrote to memory of 69700 69664 cmd.exe 35 PID 69664 wrote to memory of 69700 69664 cmd.exe 35 PID 69664 wrote to memory of 69700 69664 cmd.exe 35 PID 69664 wrote to memory of 69940 69664 cmd.exe 39 PID 69664 wrote to memory of 69940 69664 cmd.exe 39 PID 69664 wrote to memory of 69940 69664 cmd.exe 39 PID 69664 wrote to memory of 69972 69664 cmd.exe 40 PID 69664 wrote to memory of 69972 69664 cmd.exe 40 PID 69664 wrote to memory of 69972 69664 cmd.exe 40 PID 69664 wrote to memory of 70008 69664 cmd.exe 41 PID 69664 wrote to memory of 70008 69664 cmd.exe 41 PID 69664 wrote to memory of 70008 69664 cmd.exe 41 PID 69664 wrote to memory of 70040 69664 cmd.exe 42 PID 69664 wrote to memory of 70040 69664 cmd.exe 42 PID 69664 wrote to memory of 70040 69664 cmd.exe 42 PID 69664 wrote to memory of 70076 69664 cmd.exe 43 PID 69664 wrote to memory of 70076 69664 cmd.exe 43 PID 69664 wrote to memory of 70076 69664 cmd.exe 43 PID 69664 wrote to memory of 70108 69664 cmd.exe 44 PID 69664 wrote to memory of 70108 69664 cmd.exe 44 PID 69664 wrote to memory of 70108 69664 cmd.exe 44 PID 69664 wrote to memory of 70140 69664 cmd.exe 45 PID 69664 wrote to memory of 70140 69664 cmd.exe 45 PID 69664 wrote to memory of 70140 69664 cmd.exe 45 PID 69664 wrote to memory of 70172 69664 cmd.exe 46 PID 69664 wrote to memory of 70172 69664 cmd.exe 46 PID 69664 wrote to memory of 70172 69664 cmd.exe 46 PID 69664 wrote to memory of 70204 69664 cmd.exe 47 PID 69664 wrote to memory of 70204 69664 cmd.exe 47 PID 69664 wrote to memory of 70204 69664 cmd.exe 47 PID 69664 wrote to memory of 70236 69664 cmd.exe 48 PID 69664 wrote to memory of 70236 69664 cmd.exe 48 PID 69664 wrote to memory of 70236 69664 cmd.exe 48 PID 69664 wrote to memory of 70268 69664 cmd.exe 49 PID 69664 wrote to memory of 70268 69664 cmd.exe 49 PID 69664 wrote to memory of 70268 69664 cmd.exe 49 PID 69664 wrote to memory of 70300 69664 cmd.exe 50 PID 69664 wrote to memory of 70300 69664 cmd.exe 50 PID 69664 wrote to memory of 70300 69664 cmd.exe 50 PID 69664 wrote to memory of 70332 69664 cmd.exe 51 PID 69664 wrote to memory of 70332 69664 cmd.exe 51 PID 69664 wrote to memory of 70332 69664 cmd.exe 51 PID 1168 wrote to memory of 69032 1168 Dwm.exe 53 PID 1168 wrote to memory of 69032 1168 Dwm.exe 53 PID 1168 wrote to memory of 69032 1168 Dwm.exe 53 PID 69032 wrote to memory of 1116 69032 cmd.exe 55 PID 69032 wrote to memory of 1116 69032 cmd.exe 55 PID 69032 wrote to memory of 1116 69032 cmd.exe 55 PID 69032 wrote to memory of 69916 69032 cmd.exe 57 PID 69032 wrote to memory of 69916 69032 cmd.exe 57 PID 69032 wrote to memory of 69916 69032 cmd.exe 57 PID 69032 wrote to memory of 220 69032 cmd.exe 58
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69032 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Interacts with shadow copies
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1116
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:69916
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:220
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69716
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69956
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69988
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70020
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70056
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70088
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70120
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70144
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70184
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70216
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70240
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
PID:1116 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69664 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69700
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:69940
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:69972
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70008
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70040
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70076
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70108
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70140
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70172
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70204
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70236
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70268
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70300
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70332
-
-
-
C:\Users\Admin\AppData\Local\Temp\unique-membership.exe"C:\Users\Admin\AppData\Local\Temp\unique-membership.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\unique-membership.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\unique-membership.exe" /f3⤵
- Adds Run key to start application
PID:1028
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69732
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:69808