6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956

General

Target

6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
Size

69KB
MD5

13c1aeaccf79909d672f531e432e22d8
SHA1

1e7f926253ac6fdbea18cdbe44c88fe0e8290969
SHA256

6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956
SHA512

b262dcd0670666e90a0d6f0e1b2138eb850885eecd5c7057369f9001c157e6b99c5654e1559c9c81a53310c7e7699cf0bd43f812545b5dd50e2574cd8738ff02

Score

9^/10

ransomware spyware stealer

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\NewTrace.raw => C:\Users\Admin\Pictures\NewTrace.raw.2c2364	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File renamed	C:\Users\Admin\Pictures\MeasureNew.tif => C:\Users\Admin\Pictures\MeasureNew.tif.2c2364	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File renamed	C:\Users\Admin\Pictures\ResolveInstall.png => C:\Users\Admin\Pictures\ResolveInstall.png.2c2364	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File renamed	C:\Users\Admin\Pictures\StartHide.crw => C:\Users\Admin\Pictures\StartHide.crw.2c2364	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File renamed	C:\Users\Admin\Pictures\ReadCompress.raw => C:\Users\Admin\Pictures\ReadCompress.raw.2c2364	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\2C2364-Readme.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSGR3FR.LEX	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\DELIMR.FAE	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd.otf	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14996_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AIR98.POC	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10253_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00932_.WMF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ORG97.SAM	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00021_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File created	C:\Program Files\Java\jdk1.7.0_80\2C2364-Readme.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233018.WMF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ODBCR.SAM	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02218_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\NEWS.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00135_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\2C2364-Readme.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL109.XML	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNoteNames.gpd	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\LockClose.snd	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235319.WMF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\2C2364-Readme.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\VideoLAN Website.url	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\HAMMER.WAV	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\2C2364-Readme.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLCPRTID.XML	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL092.XML	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\2C2364-Readme.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB2B.BDR	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLAPPT.FAE	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10290_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14844_.GIF	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTE.CFG	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN054.XML	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1548 vssadmin.exe

pid	process
1548	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe

pid	process
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
Token: SeImpersonatePrivilege	1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
Token: SeBackupPrivilege	7572	vssvc.exe
Token: SeRestorePrivilege	7572	vssvc.exe
Token: SeAuditPrivilege	7572	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe

description	pid	process	target process
PID 1668 wrote to memory of 1548	1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe	vssadmin.exe
PID 1668 wrote to memory of 1548	1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe	vssadmin.exe
PID 1668 wrote to memory of 1548	1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe	vssadmin.exe
PID 1668 wrote to memory of 1548	1668	6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe
"C:\Users\Admin\AppData\Local\Temp\6691bd27f6ef971d61a34797ab47414635a98fe531d469134dbefed18bb42956.exe"
1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668