Analysis
-
max time kernel
260s -
max time network
279s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
splendid-plant.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
splendid-plant.exe
-
Size
170KB
-
MD5
fe51255c009bbc4f74186e7a5db0f81b
-
SHA1
b41894d7ba1402106856d49c1e42d61caf51d1d4
-
SHA256
d6c3287fb1bf01e11339acaecd09ef4adbdd8bd2644dcb4feeca862025b46a39
-
SHA512
686fb913c2a25e34ffb92634960d5cc13e50b9399138aa6ad712c106b66802204e55da3d1b0d8e5aa38f21a41477ba84d02b289e99c366a711e1a27d6ff3e15d
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\LimitTest.tiff taskhost.exe File opened for modification C:\Users\Admin\Pictures\LimitTest.tiff Dwm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\splendid-plant.exe" reg.exe -
Enumerates connected drives 3 TTPs 36 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV taskhost.exe File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02264_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTE.CFG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14791_.GIF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImageSmall.jpg Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\NL.ROGERS.COM.XML taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE.XML taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tabs.accdt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02740U.BMP taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST5EDT Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143752.GIF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00452_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR5B.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196358.WMF Dwm.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC_F_COL.HXK taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105272.WMF Dwm.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo Dwm.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.DPV taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\RyukReadMe.txt Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02424_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00159_.WMF taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Berlin Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00236_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7cm_en.dub taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01748_.GIF Dwm.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296288.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REC.CFG taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\km\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left.gif taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01568_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115843.GIF Dwm.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00538_.WMF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01293_.GIF Dwm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SplashScreen.bmp Dwm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 28 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 70204 vssadmin.exe 70260 vssadmin.exe 70104 vssadmin.exe 70308 vssadmin.exe 69884 vssadmin.exe 70336 vssadmin.exe 70208 vssadmin.exe 69948 vssadmin.exe 220 vssadmin.exe 69752 vssadmin.exe 70128 vssadmin.exe 70240 vssadmin.exe 70172 vssadmin.exe 70368 vssadmin.exe 69856 vssadmin.exe 69736 vssadmin.exe 70140 vssadmin.exe 70372 vssadmin.exe 70100 vssadmin.exe 70000 vssadmin.exe 70032 vssadmin.exe 70068 vssadmin.exe 70404 vssadmin.exe 70232 vssadmin.exe 70296 vssadmin.exe 70176 vssadmin.exe 70272 vssadmin.exe 70340 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1652 splendid-plant.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1652 splendid-plant.exe Token: SeBackupPrivilege 69764 vssvc.exe Token: SeRestorePrivilege 69764 vssvc.exe Token: SeAuditPrivilege 69764 vssvc.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1108 taskhost.exe 1176 Dwm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1340 1652 splendid-plant.exe 28 PID 1652 wrote to memory of 1340 1652 splendid-plant.exe 28 PID 1652 wrote to memory of 1340 1652 splendid-plant.exe 28 PID 1652 wrote to memory of 1108 1652 splendid-plant.exe 13 PID 1652 wrote to memory of 1176 1652 splendid-plant.exe 12 PID 1652 wrote to memory of 1340 1652 splendid-plant.exe 28 PID 1340 wrote to memory of 332 1340 cmd.exe 31 PID 1340 wrote to memory of 332 1340 cmd.exe 31 PID 1340 wrote to memory of 332 1340 cmd.exe 31 PID 1108 wrote to memory of 69700 1108 taskhost.exe 33 PID 1108 wrote to memory of 69700 1108 taskhost.exe 33 PID 1108 wrote to memory of 69700 1108 taskhost.exe 33 PID 69700 wrote to memory of 69736 69700 cmd.exe 35 PID 69700 wrote to memory of 69736 69700 cmd.exe 35 PID 69700 wrote to memory of 69736 69700 cmd.exe 35 PID 69700 wrote to memory of 70000 69700 cmd.exe 39 PID 69700 wrote to memory of 70000 69700 cmd.exe 39 PID 69700 wrote to memory of 70000 69700 cmd.exe 39 PID 69700 wrote to memory of 70032 69700 cmd.exe 40 PID 69700 wrote to memory of 70032 69700 cmd.exe 40 PID 69700 wrote to memory of 70032 69700 cmd.exe 40 PID 69700 wrote to memory of 70068 69700 cmd.exe 41 PID 69700 wrote to memory of 70068 69700 cmd.exe 41 PID 69700 wrote to memory of 70068 69700 cmd.exe 41 PID 69700 wrote to memory of 70104 69700 cmd.exe 42 PID 69700 wrote to memory of 70104 69700 cmd.exe 42 PID 69700 wrote to memory of 70104 69700 cmd.exe 42 PID 69700 wrote to memory of 70140 69700 cmd.exe 43 PID 69700 wrote to memory of 70140 69700 cmd.exe 43 PID 69700 wrote to memory of 70140 69700 cmd.exe 43 PID 69700 wrote to memory of 70176 69700 cmd.exe 44 PID 69700 wrote to memory of 70176 69700 cmd.exe 44 PID 69700 wrote to memory of 70176 69700 cmd.exe 44 PID 69700 wrote to memory of 70208 69700 cmd.exe 45 PID 69700 wrote to memory of 70208 69700 cmd.exe 45 PID 69700 wrote to memory of 70208 69700 cmd.exe 45 PID 69700 wrote to memory of 70240 69700 cmd.exe 46 PID 69700 wrote to memory of 70240 69700 cmd.exe 46 PID 69700 wrote to memory of 70240 69700 cmd.exe 46 PID 69700 wrote to memory of 70272 69700 cmd.exe 47 PID 69700 wrote to memory of 70272 69700 cmd.exe 47 PID 69700 wrote to memory of 70272 69700 cmd.exe 47 PID 69700 wrote to memory of 70308 69700 cmd.exe 48 PID 69700 wrote to memory of 70308 69700 cmd.exe 48 PID 69700 wrote to memory of 70308 69700 cmd.exe 48 PID 69700 wrote to memory of 70340 69700 cmd.exe 49 PID 69700 wrote to memory of 70340 69700 cmd.exe 49 PID 69700 wrote to memory of 70340 69700 cmd.exe 49 PID 69700 wrote to memory of 70372 69700 cmd.exe 50 PID 69700 wrote to memory of 70372 69700 cmd.exe 50 PID 69700 wrote to memory of 70372 69700 cmd.exe 50 PID 69700 wrote to memory of 70404 69700 cmd.exe 51 PID 69700 wrote to memory of 70404 69700 cmd.exe 51 PID 69700 wrote to memory of 70404 69700 cmd.exe 51 PID 1176 wrote to memory of 69676 1176 Dwm.exe 53 PID 1176 wrote to memory of 69676 1176 Dwm.exe 53 PID 1176 wrote to memory of 69676 1176 Dwm.exe 53 PID 69676 wrote to memory of 69884 69676 cmd.exe 55 PID 69676 wrote to memory of 69884 69676 cmd.exe 55 PID 69676 wrote to memory of 69884 69676 cmd.exe 55 PID 69676 wrote to memory of 69948 69676 cmd.exe 56 PID 69676 wrote to memory of 69948 69676 cmd.exe 56 PID 69676 wrote to memory of 69948 69676 cmd.exe 56 PID 69676 wrote to memory of 220 69676 cmd.exe 58
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69676 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69884
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:69948
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:220
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69752
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:69856
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70100
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70128
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70172
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70204
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70232
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70260
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70296
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70336
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70368
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69700 -
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69736
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:70000
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:70032
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70068
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70104
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70140
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70176
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70208
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70240
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70272
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70308
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70340
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70372
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70404
-
-
-
C:\Users\Admin\AppData\Local\Temp\splendid-plant.exe"C:\Users\Admin\AppData\Local\Temp\splendid-plant.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\splendid-plant.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\splendid-plant.exe" /f3⤵
- Adds Run key to start application
PID:332
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69764
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:69952