Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
14-02-2022 19:19
Static task
static1
Behavioral task
behavioral1
Sample
bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe
-
Size
60KB
-
MD5
0ed2ca539a01cdb86c88a9a1604b2005
-
SHA1
4fed7eae00bfa21938e49f33b7c6794fd7d0750c
-
SHA256
bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8
-
SHA512
34dad101cd7c5f9ff2267674d224986b9274e0e17d9ae665ca1af4ffa57408106238b1e248045465ab17c72a4b92473ab3714aefb705d95f9725a4251379c7e2
Score
10/10
Malware Config
Signatures
-
WastedLocker
Ransomware family seen in the wild since May 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 2 IoCs
pid Process 3004 Net:bin 3980 Graphics.exe -
Modifies extensions of user files 18 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ExitDisconnect.tiff.bbawasted Graphics.exe File renamed C:\Users\Admin\Pictures\UninstallBackup.tif => C:\Users\Admin\Pictures\UninstallBackup.tif.bbawasted Graphics.exe File created C:\Users\Admin\Pictures\ExitDisconnect.tiff.bbawasted_info Graphics.exe File renamed C:\Users\Admin\Pictures\HideSwitch.raw => C:\Users\Admin\Pictures\HideSwitch.raw.bbawasted Graphics.exe File created C:\Users\Admin\Pictures\UninstallBackup.tif.bbawasted_info Graphics.exe File opened for modification C:\Users\Admin\Pictures\UninstallBackup.tif.bbawasted Graphics.exe File created C:\Users\Admin\Pictures\DebugUse.raw.bbawasted_info Graphics.exe File renamed C:\Users\Admin\Pictures\EnableDismount.png => C:\Users\Admin\Pictures\EnableDismount.png.bbawasted Graphics.exe File opened for modification C:\Users\Admin\Pictures\HideSwitch.raw.bbawasted Graphics.exe File created C:\Users\Admin\Pictures\OpenImport.png.bbawasted_info Graphics.exe File created C:\Users\Admin\Pictures\EnableDismount.png.bbawasted_info Graphics.exe File opened for modification C:\Users\Admin\Pictures\DebugUse.raw.bbawasted Graphics.exe File opened for modification C:\Users\Admin\Pictures\EnableDismount.png.bbawasted Graphics.exe File renamed C:\Users\Admin\Pictures\ExitDisconnect.tiff => C:\Users\Admin\Pictures\ExitDisconnect.tiff.bbawasted Graphics.exe File created C:\Users\Admin\Pictures\HideSwitch.raw.bbawasted_info Graphics.exe File renamed C:\Users\Admin\Pictures\OpenImport.png => C:\Users\Admin\Pictures\OpenImport.png.bbawasted Graphics.exe File opened for modification C:\Users\Admin\Pictures\OpenImport.png.bbawasted Graphics.exe File renamed C:\Users\Admin\Pictures\DebugUse.raw => C:\Users\Admin\Pictures\DebugUse.raw.bbawasted Graphics.exe -
Possible privilege escalation attempt 2 IoCs
pid Process 3896 takeown.exe 3904 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 3904 icacls.exe 3896 takeown.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Graphics.exe Net:bin File opened for modification C:\Windows\SysWOW64\Graphics.exe attrib.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1252 vssadmin.exe -
Modifies data under HKEY_USERS 53 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.571502" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4384" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132895163692251174" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.536497" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4084" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Net:bin bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2184 vssvc.exe Token: SeRestorePrivilege 2184 vssvc.exe Token: SeAuditPrivilege 2184 vssvc.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe Token: SeRestorePrivilege 2688 TiWorker.exe Token: SeSecurityPrivilege 2688 TiWorker.exe Token: SeBackupPrivilege 2688 TiWorker.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 396 wrote to memory of 3004 396 bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe 61 PID 396 wrote to memory of 3004 396 bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe 61 PID 396 wrote to memory of 3004 396 bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe 61 PID 3004 wrote to memory of 1252 3004 Net:bin 64 PID 3004 wrote to memory of 1252 3004 Net:bin 64 PID 3004 wrote to memory of 3896 3004 Net:bin 69 PID 3004 wrote to memory of 3896 3004 Net:bin 69 PID 3004 wrote to memory of 3896 3004 Net:bin 69 PID 3004 wrote to memory of 3904 3004 Net:bin 71 PID 3004 wrote to memory of 3904 3004 Net:bin 71 PID 3004 wrote to memory of 3904 3004 Net:bin 71 PID 3980 wrote to memory of 648 3980 Graphics.exe 79 PID 3980 wrote to memory of 648 3980 Graphics.exe 79 PID 3980 wrote to memory of 648 3980 Graphics.exe 79 PID 648 wrote to memory of 2180 648 cmd.exe 81 PID 648 wrote to memory of 2180 648 cmd.exe 81 PID 648 wrote to memory of 2180 648 cmd.exe 81 PID 3004 wrote to memory of 988 3004 Net:bin 82 PID 3004 wrote to memory of 988 3004 Net:bin 82 PID 3004 wrote to memory of 988 3004 Net:bin 82 PID 396 wrote to memory of 1396 396 bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe 84 PID 396 wrote to memory of 1396 396 bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe 84 PID 396 wrote to memory of 1396 396 bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe 84 PID 1396 wrote to memory of 276 1396 cmd.exe 87 PID 1396 wrote to memory of 276 1396 cmd.exe 87 PID 1396 wrote to memory of 276 1396 cmd.exe 87 PID 988 wrote to memory of 284 988 cmd.exe 86 PID 988 wrote to memory of 284 988 cmd.exe 86 PID 988 wrote to memory of 284 988 cmd.exe 86 PID 648 wrote to memory of 3316 648 cmd.exe 93 PID 648 wrote to memory of 3316 648 cmd.exe 93 PID 648 wrote to memory of 3316 648 cmd.exe 93 PID 1396 wrote to memory of 1572 1396 cmd.exe 95 PID 1396 wrote to memory of 1572 1396 cmd.exe 95 PID 1396 wrote to memory of 1572 1396 cmd.exe 95 PID 988 wrote to memory of 2860 988 cmd.exe 94 PID 988 wrote to memory of 2860 988 cmd.exe 94 PID 988 wrote to memory of 2860 988 cmd.exe 94 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 3316 attrib.exe 2860 attrib.exe 1572 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe"C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Roaming\Net:binC:\Users\Admin\AppData\Roaming\Net:bin -r2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:1252
-
-
C:\Windows\SysWOW64\takeown.exeC:\Windows\system32\takeown.exe /F C:\Windows\system32\Graphics.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3896
-
-
C:\Windows\SysWOW64\icacls.exeC:\Windows\system32\icacls.exe C:\Windows\system32\Graphics.exe /reset3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3904
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Roaming\Net" & del "C:\Users\Admin\AppData\Roaming\Net"3⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y4⤵PID:284
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Roaming\Net"4⤵
- Views/modifies file attributes
PID:2860
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe" & del "C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:276
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Users\Admin\AppData\Local\Temp\bcdac1a2b67e2b47f8129814dca3bcf7d55404757eb09f1c3103f57da3153ec8.exe"3⤵
- Views/modifies file attributes
PID:1572
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3364
-
C:\Windows\SysWOW64\Graphics.exeC:\Windows\SysWOW64\Graphics.exe -s1⤵
- Executes dropped EXE
- Modifies extensions of user files
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\cmd.execmd /c choice /t 10 /d y & attrib -h "C:\Windows\SysWOW64\Graphics.exe" & del "C:\Windows\SysWOW64\Graphics.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\SysWOW64\choice.exechoice /t 10 /d y3⤵PID:2180
-
-
C:\Windows\SysWOW64\attrib.exeattrib -h "C:\Windows\SysWOW64\Graphics.exe"3⤵
- Drops file in System32 directory
- Views/modifies file attributes
PID:3316
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1364
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2688