Malware Analysis Report

2024-10-16 03:23

Sample ID 210822-x4cnyk6qyj
Target 2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe
SHA256 2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf
Tags
babuk ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf

Threat Level: Known bad

The file 2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe was found to be: Known bad.

Malicious Activity Summary

babuk ransomware

Babuk Locker

Deletes shadow copies

Modifies extensions of user files

Enumerates connected drives

Enumerates physical storage devices

Interacts with shadow copies

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-08-22 09:24

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2021-08-22 09:24

Reported

2021-08-22 09:27

Platform

win10v20210408

Max time kernel

35s

Max time network

69s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe"

Signatures

Babuk Locker

ransomware babuk

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\PushExit.tiff C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\ReadAdd.raw => C:\Users\Admin\Pictures\ReadAdd.raw.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\SendConvertFrom.png => C:\Users\Admin\Pictures\SendConvertFrom.png.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\SetUnlock.tiff C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\StepUnpublish.raw => C:\Users\Admin\Pictures\StepUnpublish.raw.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\DenyUnlock.tiff => C:\Users\Admin\Pictures\DenyUnlock.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\MountStart.png => C:\Users\Admin\Pictures\MountStart.png.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\MoveExport.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\SetUnlock.tiff => C:\Users\Admin\Pictures\SetUnlock.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\UnprotectApprove.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\SetStep.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\DenyUnlock.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\PushExit.tiff => C:\Users\Admin\Pictures\PushExit.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\ReadAdd.raw.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\SendConvertFrom.png.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\StepUnpublish.raw.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\SetUnlock.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\UnprotectApprove.tif => C:\Users\Admin\Pictures\UnprotectApprove.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\DenyUnlock.tiff C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\MoveExport.tif => C:\Users\Admin\Pictures\MoveExport.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\PushExit.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\SetStep.tiff C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\SetStep.tiff => C:\Users\Admin\Pictures\SetStep.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\AddUnlock.tif => C:\Users\Admin\Pictures\AddUnlock.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\AddUnlock.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\MountStart.png.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe

"C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\How To Restore Your Files.txt

Network

N/A

Files

memory/3560-114-0x0000000000000000-mapping.dmp

memory/3892-115-0x0000000000000000-mapping.dmp

memory/1276-116-0x0000000000000000-mapping.dmp

memory/1080-117-0x0000000000000000-mapping.dmp

C:\Users\Admin\Desktop\How To Restore Your Files.txt

MD5 655a099a144e6164ba891274ac9aa406
SHA1 66c4292b9f1b516ec0869adcd64efeb5c4bd1917
SHA256 cfad30c98f7fdd4c40a88994cb4d2f8499d67525ac92031d1f77595164b27b71
SHA512 3fc847a23a2fbc3a03607195451a22caf3cd867d4085796d8ddb4e6b490cd303524c22c75d9b9f204b17d62f089692fd8f11d9275a10e15da62ae3bcf2fedecf

Analysis: behavioral1

Detonation Overview

Submitted

2021-08-22 09:24

Reported

2021-08-22 09:27

Platform

win7v20210410

Max time kernel

11s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe"

Signatures

Babuk Locker

ransomware babuk

Deletes shadow copies

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\InitializeStep.tif => C:\Users\Admin\Pictures\InitializeStep.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\InitializeStep.tif.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File renamed C:\Users\Admin\Pictures\RemoveStart.tiff => C:\Users\Admin\Pictures\RemoveStart.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened for modification C:\Users\Admin\Pictures\RemoveStart.tiff.babyk C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 2004 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 2004 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 2004 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 1464 wrote to memory of 1968 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1464 wrote to memory of 1968 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1464 wrote to memory of 1968 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 2004 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 2004 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 2004 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 2004 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe C:\Windows\System32\cmd.exe
PID 1088 wrote to memory of 744 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1088 wrote to memory of 744 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 1088 wrote to memory of 744 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\vssadmin.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe

"C:\Users\Admin\AppData\Local\Temp\2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe delete shadows /all /quiet

Network

N/A

Files

memory/2004-60-0x00000000765F1000-0x00000000765F3000-memory.dmp

memory/1464-61-0x0000000000000000-mapping.dmp

memory/1968-62-0x0000000000000000-mapping.dmp

memory/1088-63-0x0000000000000000-mapping.dmp

memory/744-64-0x0000000000000000-mapping.dmp