Analysis
-
max time kernel
262s -
max time network
78s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
unbecoming-computer.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
unbecoming-computer.exe
-
Size
170KB
-
MD5
72560e20ba50a2e239290d563fd0a6f7
-
SHA1
11f2f2f09c04e39f8b353dcddb8773db2fa11b01
-
SHA256
69a9adad4068dc93bd994d807da2176b96be437696564cb2eeb819977ea6cddc
-
SHA512
32b2f3dd619b45ae0ea18c05a82fe4f25479dcaac125bd838abd93512e679120ad3b54af553cea369814137a469b673918611d034046a9c051cf308538058b07
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\unbecoming-computer.exe" reg.exe -
Enumerates connected drives 3 TTPs 32 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw Dwm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PIXEL.INF Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\EST5 taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\plugins.dat taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml taskhost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44F.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.DPV taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10 Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser_5.5.0.165303.jar Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00555_.WMF Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png taskhost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\PREVIEW.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0197979.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01293_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LISTBOX.JPG taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Araguaina Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01080_.WMF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Monrovia Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199036.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.SE.XML taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\CONCRETE.INF Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.XML Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WHIRL1.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackground.jpg taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309567.JPG Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST7MDT taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00014_.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chihuahua Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\THMBNAIL.PNG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222015.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 25 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 70044 vssadmin.exe 11968 vssadmin.exe 26404 vssadmin.exe 69900 vssadmin.exe 16368 vssadmin.exe 70384 vssadmin.exe 70632 vssadmin.exe 70020 vssadmin.exe 232 vssadmin.exe 20892 vssadmin.exe 23448 vssadmin.exe 21520 vssadmin.exe 33820 vssadmin.exe 19420 vssadmin.exe 23680 vssadmin.exe 70108 vssadmin.exe 1696 vssadmin.exe 19284 vssadmin.exe 11960 vssadmin.exe 16284 vssadmin.exe 29184 vssadmin.exe 70496 vssadmin.exe 70228 vssadmin.exe 26436 vssadmin.exe 29092 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 768 unbecoming-computer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 768 unbecoming-computer.exe Token: SeBackupPrivilege 69932 vssvc.exe Token: SeRestorePrivilege 69932 vssvc.exe Token: SeAuditPrivilege 69932 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1136 taskhost.exe 1252 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 768 wrote to memory of 1340 768 unbecoming-computer.exe 29 PID 768 wrote to memory of 1340 768 unbecoming-computer.exe 29 PID 768 wrote to memory of 1340 768 unbecoming-computer.exe 29 PID 768 wrote to memory of 1136 768 unbecoming-computer.exe 15 PID 1340 wrote to memory of 628 1340 cmd.exe 31 PID 1340 wrote to memory of 628 1340 cmd.exe 31 PID 1340 wrote to memory of 628 1340 cmd.exe 31 PID 768 wrote to memory of 1252 768 unbecoming-computer.exe 14 PID 1136 wrote to memory of 69864 1136 taskhost.exe 33 PID 1136 wrote to memory of 69864 1136 taskhost.exe 33 PID 1136 wrote to memory of 69864 1136 taskhost.exe 33 PID 69864 wrote to memory of 69900 69864 cmd.exe 35 PID 69864 wrote to memory of 69900 69864 cmd.exe 35 PID 69864 wrote to memory of 69900 69864 cmd.exe 35 PID 69864 wrote to memory of 11960 69864 cmd.exe 39 PID 69864 wrote to memory of 11960 69864 cmd.exe 39 PID 69864 wrote to memory of 11960 69864 cmd.exe 39 PID 69864 wrote to memory of 16284 69864 cmd.exe 40 PID 69864 wrote to memory of 16284 69864 cmd.exe 40 PID 69864 wrote to memory of 16284 69864 cmd.exe 40 PID 69864 wrote to memory of 16368 69864 cmd.exe 41 PID 69864 wrote to memory of 16368 69864 cmd.exe 41 PID 69864 wrote to memory of 16368 69864 cmd.exe 41 PID 69864 wrote to memory of 19420 69864 cmd.exe 42 PID 69864 wrote to memory of 19420 69864 cmd.exe 42 PID 69864 wrote to memory of 19420 69864 cmd.exe 42 PID 69864 wrote to memory of 21520 69864 cmd.exe 43 PID 69864 wrote to memory of 21520 69864 cmd.exe 43 PID 69864 wrote to memory of 21520 69864 cmd.exe 43 PID 69864 wrote to memory of 23680 69864 cmd.exe 44 PID 69864 wrote to memory of 23680 69864 cmd.exe 44 PID 69864 wrote to memory of 23680 69864 cmd.exe 44 PID 69864 wrote to memory of 26436 69864 cmd.exe 45 PID 69864 wrote to memory of 26436 69864 cmd.exe 45 PID 69864 wrote to memory of 26436 69864 cmd.exe 45 PID 69864 wrote to memory of 29092 69864 cmd.exe 46 PID 69864 wrote to memory of 29092 69864 cmd.exe 46 PID 69864 wrote to memory of 29092 69864 cmd.exe 46 PID 69864 wrote to memory of 29184 69864 cmd.exe 47 PID 69864 wrote to memory of 29184 69864 cmd.exe 47 PID 69864 wrote to memory of 29184 69864 cmd.exe 47 PID 69864 wrote to memory of 33820 69864 cmd.exe 48 PID 69864 wrote to memory of 33820 69864 cmd.exe 48 PID 69864 wrote to memory of 33820 69864 cmd.exe 48 PID 1252 wrote to memory of 70088 1252 Dwm.exe 50 PID 1252 wrote to memory of 70088 1252 Dwm.exe 50 PID 1252 wrote to memory of 70088 1252 Dwm.exe 50 PID 70088 wrote to memory of 70108 70088 cmd.exe 52 PID 70088 wrote to memory of 70108 70088 cmd.exe 52 PID 70088 wrote to memory of 70108 70088 cmd.exe 52 PID 70088 wrote to memory of 70496 70088 cmd.exe 54 PID 70088 wrote to memory of 70496 70088 cmd.exe 54 PID 70088 wrote to memory of 70496 70088 cmd.exe 54 PID 70088 wrote to memory of 70384 70088 cmd.exe 55 PID 70088 wrote to memory of 70384 70088 cmd.exe 55 PID 70088 wrote to memory of 70384 70088 cmd.exe 55 PID 70088 wrote to memory of 1696 70088 cmd.exe 56 PID 70088 wrote to memory of 1696 70088 cmd.exe 56 PID 70088 wrote to memory of 1696 70088 cmd.exe 56 PID 70088 wrote to memory of 70632 70088 cmd.exe 57 PID 70088 wrote to memory of 70632 70088 cmd.exe 57 PID 70088 wrote to memory of 70632 70088 cmd.exe 57 PID 70088 wrote to memory of 70044 70088 cmd.exe 58 PID 70088 wrote to memory of 70044 70088 cmd.exe 58
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:70088 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70108
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70496
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70384
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1696
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70632
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70044
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70020
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:232
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:11968
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70228
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:19284
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:20892
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:23448
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:26404
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69864 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69900
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:11960
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:16284
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:16368
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:19420
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:21520
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:23680
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:26436
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:29092
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:29184
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:33820
-
-
-
C:\Users\Admin\AppData\Local\Temp\unbecoming-computer.exe"C:\Users\Admin\AppData\Local\Temp\unbecoming-computer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\unbecoming-computer.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\unbecoming-computer.exe" /f3⤵
- Adds Run key to start application
PID:628
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69932
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:70180