Analysis
-
max time kernel
162s -
max time network
32s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
01-02-2022 01:34
Static task
static1
Behavioral task
behavioral1
Sample
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe
Resource
win10v2004-en-20220112
General
-
Target
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe
-
Size
80KB
-
MD5
5cf25a50ae26c6c97a6ecd0e27b41541
-
SHA1
6e8d04cb4665ff7ad04d92e21d6b1791798639ac
-
SHA256
20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d
-
SHA512
26758d1496a8ec616d9a490d839baeb4fd61ae1bfabf923c83f8bce1165e29449cbaaa2504b32bb6b68066c9b39eb7374c6ec09846770681d4b2f7738737a637
Malware Config
Extracted
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0AD26D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Signatures
-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\InvokeSelect.tiff 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL078.XML 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN110.XML 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149407.WMF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\0AD26D-Readme.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Adjacency.thmx 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL090.XML 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART4.BDR 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233018.WMF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216858.WMF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.policy 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\0AD26D-Readme.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fa.pak 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\APPT.CFG 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLNOTE.FAE 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\0AD26D-Readme.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\Whistling.wav 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\MLA.XSL 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7db.kic 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jre7\lib\content-types.properties 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\0AD26D-Readme.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Newsprint.thmx 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195534.WMF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\0AD26D-Readme.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Installed_schemas14.xss 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\DELIMDOS.FAE 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\AUTHOR.XSL 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunjce_provider.jar 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ACCTBOX.POC 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\OUTEX.ECF 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\he.pak 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\0AD26D-Readme.txt 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL097.XML 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB3A.BDR 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN001.XML 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\TYPE.WAV 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Microsoft Office\Office14\Custom.propdesc 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\resources.pak 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\APPLAUSE.WAV 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\cs.pak 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN082.XML 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 520 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe Token: SeImpersonatePrivilege 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe Token: SeBackupPrivilege 7564 vssvc.exe Token: SeRestorePrivilege 7564 vssvc.exe Token: SeAuditPrivilege 7564 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 520 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 27 PID 1700 wrote to memory of 520 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 27 PID 1700 wrote to memory of 520 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 27 PID 1700 wrote to memory of 520 1700 20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe"C:\Users\Admin\AppData\Local\Temp\20807e0f8171807c8f0c443df26ea852c7bfb4988d37e7874615cc840573cc9d.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:520
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7564