Analysis
-
max time kernel
187s -
max time network
279s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
sharp-recording.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
sharp-recording.exe
-
Size
170KB
-
MD5
dea9c5b2594f41331a5bd4518379f6e4
-
SHA1
a3ba4a6cc9506a1c5d5789926946b3166cbcb20b
-
SHA256
98d8caafaae6458a621ba1d1a1889709d155bd7dc87b9f7dd2ed7ebd2d0d166e
-
SHA512
20d8accea3cb85bb38ba6ec6390151971dc75c84a8b471e62e4a8b718a3ac77e79bb3917fd796b69cc5b505e2ea901141f67ceac9576df810d4f481440ded94e
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ApproveExport.tiff taskhost.exe File opened for modification C:\Users\Admin\Pictures\WatchConvert.tiff taskhost.exe File opened for modification C:\Users\Admin\Pictures\ApproveExport.tiff Dwm.exe File opened for modification C:\Users\Admin\Pictures\WatchConvert.tiff Dwm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sharp-recording.exe" reg.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\mn.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382962.JPG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_07.MID taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCDRESTS.ICO Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HEADER.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME34.CSS taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ProjectStatusReport.potx taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182888.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis.css taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212953.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Miquelon Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Flow.thmx Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188679.WMF taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01065_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88 Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RESENDS.ICO Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME28.CSS taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME33.CSS taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt Dwm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.IE.XML Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zaporozhye taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bg\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105412.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740U.BMP Dwm.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime.css taskhost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt Dwm.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml Dwm.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\INDUST.INF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html Dwm.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0250504.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00505_.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR16F.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Premium.css taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 28 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 70376 vssadmin.exe 70160 vssadmin.exe 70440 vssadmin.exe 70200 vssadmin.exe 70496 vssadmin.exe 300 vssadmin.exe 70216 vssadmin.exe 70312 vssadmin.exe 70128 vssadmin.exe 70392 vssadmin.exe 70608 vssadmin.exe 70076 vssadmin.exe 70108 vssadmin.exe 70408 vssadmin.exe 70444 vssadmin.exe 70472 vssadmin.exe 70412 vssadmin.exe 69936 vssadmin.exe 70236 vssadmin.exe 69912 vssadmin.exe 70344 vssadmin.exe 70280 vssadmin.exe 70292 vssadmin.exe 70540 vssadmin.exe 1120 vssadmin.exe 70140 vssadmin.exe 70248 vssadmin.exe 70180 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1960 sharp-recording.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1960 sharp-recording.exe Token: SeBackupPrivilege 69940 vssvc.exe Token: SeRestorePrivilege 69940 vssvc.exe Token: SeAuditPrivilege 69940 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1172 taskhost.exe 1304 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1776 1960 sharp-recording.exe 28 PID 1960 wrote to memory of 1776 1960 sharp-recording.exe 28 PID 1960 wrote to memory of 1776 1960 sharp-recording.exe 28 PID 1960 wrote to memory of 1172 1960 sharp-recording.exe 11 PID 1960 wrote to memory of 1304 1960 sharp-recording.exe 9 PID 1960 wrote to memory of 1776 1960 sharp-recording.exe 28 PID 1776 wrote to memory of 1724 1776 cmd.exe 31 PID 1776 wrote to memory of 1724 1776 cmd.exe 31 PID 1776 wrote to memory of 1724 1776 cmd.exe 31 PID 1172 wrote to memory of 69876 1172 taskhost.exe 35 PID 1172 wrote to memory of 69876 1172 taskhost.exe 35 PID 1172 wrote to memory of 69876 1172 taskhost.exe 35 PID 69876 wrote to memory of 69912 69876 cmd.exe 36 PID 69876 wrote to memory of 69912 69876 cmd.exe 36 PID 69876 wrote to memory of 69912 69876 cmd.exe 36 PID 69876 wrote to memory of 70076 69876 cmd.exe 39 PID 69876 wrote to memory of 70076 69876 cmd.exe 39 PID 69876 wrote to memory of 70076 69876 cmd.exe 39 PID 69876 wrote to memory of 70108 69876 cmd.exe 40 PID 69876 wrote to memory of 70108 69876 cmd.exe 40 PID 69876 wrote to memory of 70108 69876 cmd.exe 40 PID 69876 wrote to memory of 70140 69876 cmd.exe 41 PID 69876 wrote to memory of 70140 69876 cmd.exe 41 PID 69876 wrote to memory of 70140 69876 cmd.exe 41 PID 69876 wrote to memory of 70180 69876 cmd.exe 42 PID 69876 wrote to memory of 70180 69876 cmd.exe 42 PID 69876 wrote to memory of 70180 69876 cmd.exe 42 PID 69876 wrote to memory of 70216 69876 cmd.exe 43 PID 69876 wrote to memory of 70216 69876 cmd.exe 43 PID 69876 wrote to memory of 70216 69876 cmd.exe 43 PID 69876 wrote to memory of 70248 69876 cmd.exe 44 PID 69876 wrote to memory of 70248 69876 cmd.exe 44 PID 69876 wrote to memory of 70248 69876 cmd.exe 44 PID 69876 wrote to memory of 70280 69876 cmd.exe 45 PID 69876 wrote to memory of 70280 69876 cmd.exe 45 PID 69876 wrote to memory of 70280 69876 cmd.exe 45 PID 69876 wrote to memory of 70312 69876 cmd.exe 46 PID 69876 wrote to memory of 70312 69876 cmd.exe 46 PID 69876 wrote to memory of 70312 69876 cmd.exe 46 PID 69876 wrote to memory of 70344 69876 cmd.exe 47 PID 69876 wrote to memory of 70344 69876 cmd.exe 47 PID 69876 wrote to memory of 70344 69876 cmd.exe 47 PID 69876 wrote to memory of 70376 69876 cmd.exe 48 PID 69876 wrote to memory of 70376 69876 cmd.exe 48 PID 69876 wrote to memory of 70376 69876 cmd.exe 48 PID 69876 wrote to memory of 70408 69876 cmd.exe 49 PID 69876 wrote to memory of 70408 69876 cmd.exe 49 PID 69876 wrote to memory of 70408 69876 cmd.exe 49 PID 69876 wrote to memory of 70440 69876 cmd.exe 50 PID 69876 wrote to memory of 70440 69876 cmd.exe 50 PID 69876 wrote to memory of 70440 69876 cmd.exe 50 PID 69876 wrote to memory of 70472 69876 cmd.exe 51 PID 69876 wrote to memory of 70472 69876 cmd.exe 51 PID 69876 wrote to memory of 70472 69876 cmd.exe 51 PID 1304 wrote to memory of 212 1304 Dwm.exe 53 PID 1304 wrote to memory of 212 1304 Dwm.exe 53 PID 1304 wrote to memory of 212 1304 Dwm.exe 53 PID 212 wrote to memory of 69936 212 cmd.exe 56 PID 212 wrote to memory of 69936 212 cmd.exe 56 PID 212 wrote to memory of 69936 212 cmd.exe 56 PID 212 wrote to memory of 70128 212 cmd.exe 57 PID 212 wrote to memory of 70128 212 cmd.exe 57 PID 212 wrote to memory of 70128 212 cmd.exe 57 PID 212 wrote to memory of 70160 212 cmd.exe 58
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69936
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70128
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70160
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70200
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70236
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70292
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70392
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70412
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70444
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70496
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70540
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70608
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1120
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:300
-
-
-
C:\Users\Admin\AppData\Local\Temp\sharp-recording.exe"C:\Users\Admin\AppData\Local\Temp\sharp-recording.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\sharp-recording.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\sharp-recording.exe" /f3⤵
- Adds Run key to start application
PID:1724
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69876 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69912
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70076
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70108
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70140
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70180
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70216
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70248
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70280
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70312
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70344
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70376
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70408
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70440
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70472
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69940
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:69928