Analysis
-
max time kernel
156s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 01:23
Static task
static1
Behavioral task
behavioral1
Sample
bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe
-
Size
69KB
-
MD5
e76a79e2d13f40bb0464b6d0168f5790
-
SHA1
cff4edd3f058214e820a3390f53353df0ccca814
-
SHA256
bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6
-
SHA512
d813e5f48d24fe6683d66e7b3d10e4b27c6e33e5420b764d9c0ce60e4217c17eb9f0f8ed666ddd835081bb29af18196eda6c9555b22ad5088d24e21554f90c9d
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BS4BOXES.POC bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN086.XML bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGDIC.DAT bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\Java\jre7\lib\currency.data bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\752169-Readme.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\WIND.WAV bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\DELIMR.FAE bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL103.XML bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.HTM bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\752169-Readme.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNoteNames.gpd bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File created C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\752169-Readme.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZDAT12.ACCDU bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.Runtime.xml bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\digest.s bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN048.XML bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Equity.thmx bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB8.BDR bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.UDT bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\Windows Journal\Templates\Genko_1.jtp bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL022.XML bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.LEX bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB11.BDR bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN092.XML bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\mobile.css bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\ResolveUnlock.dwg bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB1B.BDR bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\modules\dkjson.luac bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSMMS.CFG bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\powerpnt.exe.manifest bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\3082\MSO.ACL bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.ES.XML bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.HTM bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\LICENSE bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 592 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe Token: SeImpersonatePrivilege 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1776 wrote to memory of 592 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 27 PID 1776 wrote to memory of 592 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 27 PID 1776 wrote to memory of 592 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 27 PID 1776 wrote to memory of 592 1776 bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe"C:\Users\Admin\AppData\Local\Temp\bb00fd154b28cd6cc130cbaaabe3f92edcd5c674153f44734bad34009ddb94f6.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:592
-