Analysis
-
max time kernel
160s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 01:30
Static task
static1
Behavioral task
behavioral1
Sample
6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
-
Size
69KB
-
MD5
13c1aeaccf79909d672f531e432e22d8
-
SHA1
1e7f926253ac6fdbea18cdbe44c88fe0e8290969
-
SHA256
6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956
-
SHA512
b262dcd0670666e90a0d6f0e1b2138eb850885eecd5c7057369f9001c157e6b99c5654e1559c9c81a53310c7e7699cf0bd43f812545b5dd50e2574cd8738ff02
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\NewTrace.raw => C:\Users\Admin\Pictures\NewTrace.raw.2c2364 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File renamed C:\Users\Admin\Pictures\MeasureNew.tif => C:\Users\Admin\Pictures\MeasureNew.tif.2c2364 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File renamed C:\Users\Admin\Pictures\ResolveInstall.png => C:\Users\Admin\Pictures\ResolveInstall.png.2c2364 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File renamed C:\Users\Admin\Pictures\StartHide.crw => C:\Users\Admin\Pictures\StartHide.crw.2c2364 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File renamed C:\Users\Admin\Pictures\ReadCompress.raw => C:\Users\Admin\Pictures\ReadCompress.raw.2c2364 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\2C2364-Readme.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSGR3FR.LEX 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\DELIMR.FAE 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14996_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AIR98.POC 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10253_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ORG97.SAM 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File created C:\Program Files\Java\jdk1.7.0_80\2C2364-Readme.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233018.WMF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ODBCR.SAM 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02218_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\2C2364-Readme.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL109.XML 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNoteNames.gpd 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\LockClose.snd 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235319.WMF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\2C2364-Readme.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\HAMMER.WAV 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\2C2364-Readme.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLCPRTID.XML 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL092.XML 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File created C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\2C2364-Readme.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB2B.BDR 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLAPPT.FAE 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10290_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14844_.GIF 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTE.CFG 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN054.XML 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1548 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe Token: SeImpersonatePrivilege 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe Token: SeBackupPrivilege 7572 vssvc.exe Token: SeRestorePrivilege 7572 vssvc.exe Token: SeAuditPrivilege 7572 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1548 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 27 PID 1668 wrote to memory of 1548 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 27 PID 1668 wrote to memory of 1548 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 27 PID 1668 wrote to memory of 1548 1668 6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe"C:\Users\Admin\AppData\Local\Temp\6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1548
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7572