Analysis
-
max time kernel
148s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 19:52
Static task
static1
Behavioral task
behavioral1
Sample
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe
Resource
win10v2004-en-20220112
General
-
Target
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe
-
Size
76KB
-
MD5
f34052fe70c4ec35899aeaee7386f2e0
-
SHA1
57b6cd016c158e15736969d63d8626af4b483d8d
-
SHA256
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371
-
SHA512
478f0974ad408258f784fc897f9af76c3d37603b8cfd048132f13281ddf70fb60ded1b6f4b6d4a997b6ff71ed3be68f0659e35ed50ddefd0020a4634303bca13
Malware Config
Extracted
C:\readme.txt
conti
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.top
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConvertFromStop.raw => C:\Users\Admin\Pictures\ConvertFromStop.raw.FEEDC eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File renamed C:\Users\Admin\Pictures\InitializeProtect.crw => C:\Users\Admin\Pictures\InitializeProtect.crw.FEEDC eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File renamed C:\Users\Admin\Pictures\InstallDisconnect.raw => C:\Users\Admin\Pictures\InstallDisconnect.raw.FEEDC eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File renamed C:\Users\Admin\Pictures\RequestDisable.tif => C:\Users\Admin\Pictures\RequestDisable.tif.FEEDC eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File renamed C:\Users\Admin\Pictures\SearchGrant.tif => C:\Users\Admin\Pictures\SearchGrant.tif.FEEDC eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File renamed C:\Users\Admin\Pictures\SendComplete.png => C:\Users\Admin\Pictures\SendComplete.png.FEEDC eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe -
Drops desktop.ini file(s) 31 IoCs
Processes:
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exedescription ioc process File opened for modification C:\Program Files (x86)\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Libraries\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Music\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Documents\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Links\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Music\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Searches\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Downloads\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Desktop\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Pictures\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Public\Videos\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Documents\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Users\Admin\Videos\desktop.ini eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe -
Drops file in Program Files directory 64 IoCs
Processes:
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exedescription ioc process File opened for modification C:\Program Files\Java\jre7\lib\alt-rt.jar eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Common Files\Services\verisign.bmp eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SPANISH.LNG eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\MountUpdate.kix eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\bdcmetadataresource.xsd eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Common Files\microsoft shared\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Apothecary.thmx eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01630_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00799_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\adovbs.inc eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00234_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00449_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Oriel.thmx eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01366_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Common Files\Adobe\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Clarity.thmx eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.rll eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00161_.GIF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files\Microsoft Games\More Games\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSN.ICO eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SketchPadTestSchema.xml eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD10890_.GIF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files\Internet Explorer\images\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Perspective.thmx eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ENGDIC.DAT eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00076_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02068_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files\Microsoft Games\Purble Place\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RSWOP.ICM eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\readme.txt eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ED00010_.WMF eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe File opened for modification C:\Program Files\PublishTrace.fon eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exepid process 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
vssvc.exeWMIC.exeWMIC.exedescription pid process Token: SeBackupPrivilege 548 vssvc.exe Token: SeRestorePrivilege 548 vssvc.exe Token: SeAuditPrivilege 548 vssvc.exe Token: SeIncreaseQuotaPrivilege 1116 WMIC.exe Token: SeSecurityPrivilege 1116 WMIC.exe Token: SeTakeOwnershipPrivilege 1116 WMIC.exe Token: SeLoadDriverPrivilege 1116 WMIC.exe Token: SeSystemProfilePrivilege 1116 WMIC.exe Token: SeSystemtimePrivilege 1116 WMIC.exe Token: SeProfSingleProcessPrivilege 1116 WMIC.exe Token: SeIncBasePriorityPrivilege 1116 WMIC.exe Token: SeCreatePagefilePrivilege 1116 WMIC.exe Token: SeBackupPrivilege 1116 WMIC.exe Token: SeRestorePrivilege 1116 WMIC.exe Token: SeShutdownPrivilege 1116 WMIC.exe Token: SeDebugPrivilege 1116 WMIC.exe Token: SeSystemEnvironmentPrivilege 1116 WMIC.exe Token: SeRemoteShutdownPrivilege 1116 WMIC.exe Token: SeUndockPrivilege 1116 WMIC.exe Token: SeManageVolumePrivilege 1116 WMIC.exe Token: 33 1116 WMIC.exe Token: 34 1116 WMIC.exe Token: 35 1116 WMIC.exe Token: SeIncreaseQuotaPrivilege 1116 WMIC.exe Token: SeSecurityPrivilege 1116 WMIC.exe Token: SeTakeOwnershipPrivilege 1116 WMIC.exe Token: SeLoadDriverPrivilege 1116 WMIC.exe Token: SeSystemProfilePrivilege 1116 WMIC.exe Token: SeSystemtimePrivilege 1116 WMIC.exe Token: SeProfSingleProcessPrivilege 1116 WMIC.exe Token: SeIncBasePriorityPrivilege 1116 WMIC.exe Token: SeCreatePagefilePrivilege 1116 WMIC.exe Token: SeBackupPrivilege 1116 WMIC.exe Token: SeRestorePrivilege 1116 WMIC.exe Token: SeShutdownPrivilege 1116 WMIC.exe Token: SeDebugPrivilege 1116 WMIC.exe Token: SeSystemEnvironmentPrivilege 1116 WMIC.exe Token: SeRemoteShutdownPrivilege 1116 WMIC.exe Token: SeUndockPrivilege 1116 WMIC.exe Token: SeManageVolumePrivilege 1116 WMIC.exe Token: 33 1116 WMIC.exe Token: 34 1116 WMIC.exe Token: 35 1116 WMIC.exe Token: SeIncreaseQuotaPrivilege 1044 WMIC.exe Token: SeSecurityPrivilege 1044 WMIC.exe Token: SeTakeOwnershipPrivilege 1044 WMIC.exe Token: SeLoadDriverPrivilege 1044 WMIC.exe Token: SeSystemProfilePrivilege 1044 WMIC.exe Token: SeSystemtimePrivilege 1044 WMIC.exe Token: SeProfSingleProcessPrivilege 1044 WMIC.exe Token: SeIncBasePriorityPrivilege 1044 WMIC.exe Token: SeCreatePagefilePrivilege 1044 WMIC.exe Token: SeBackupPrivilege 1044 WMIC.exe Token: SeRestorePrivilege 1044 WMIC.exe Token: SeShutdownPrivilege 1044 WMIC.exe Token: SeDebugPrivilege 1044 WMIC.exe Token: SeSystemEnvironmentPrivilege 1044 WMIC.exe Token: SeRemoteShutdownPrivilege 1044 WMIC.exe Token: SeUndockPrivilege 1044 WMIC.exe Token: SeManageVolumePrivilege 1044 WMIC.exe Token: 33 1044 WMIC.exe Token: 34 1044 WMIC.exe Token: 35 1044 WMIC.exe Token: SeIncreaseQuotaPrivilege 1044 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1088 wrote to memory of 1412 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1412 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1412 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1412 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1412 wrote to memory of 1116 1412 cmd.exe WMIC.exe PID 1412 wrote to memory of 1116 1412 cmd.exe WMIC.exe PID 1412 wrote to memory of 1116 1412 cmd.exe WMIC.exe PID 1088 wrote to memory of 1632 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1632 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1632 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1632 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1632 wrote to memory of 1044 1632 cmd.exe WMIC.exe PID 1632 wrote to memory of 1044 1632 cmd.exe WMIC.exe PID 1632 wrote to memory of 1044 1632 cmd.exe WMIC.exe PID 1088 wrote to memory of 1900 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1900 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1900 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1900 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1900 wrote to memory of 1748 1900 cmd.exe WMIC.exe PID 1900 wrote to memory of 1748 1900 cmd.exe WMIC.exe PID 1900 wrote to memory of 1748 1900 cmd.exe WMIC.exe PID 1088 wrote to memory of 1656 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1656 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1656 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1656 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1656 wrote to memory of 1016 1656 cmd.exe WMIC.exe PID 1656 wrote to memory of 1016 1656 cmd.exe WMIC.exe PID 1656 wrote to memory of 1016 1656 cmd.exe WMIC.exe PID 1088 wrote to memory of 1512 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1512 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1512 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1512 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1512 wrote to memory of 1716 1512 cmd.exe WMIC.exe PID 1512 wrote to memory of 1716 1512 cmd.exe WMIC.exe PID 1512 wrote to memory of 1716 1512 cmd.exe WMIC.exe PID 1088 wrote to memory of 612 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 612 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 612 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 612 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 612 wrote to memory of 1224 612 cmd.exe WMIC.exe PID 612 wrote to memory of 1224 612 cmd.exe WMIC.exe PID 612 wrote to memory of 1224 612 cmd.exe WMIC.exe PID 1088 wrote to memory of 1912 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1912 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1912 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1912 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1912 wrote to memory of 908 1912 cmd.exe WMIC.exe PID 1912 wrote to memory of 908 1912 cmd.exe WMIC.exe PID 1912 wrote to memory of 908 1912 cmd.exe WMIC.exe PID 1088 wrote to memory of 1756 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1756 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1756 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1756 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1756 wrote to memory of 1220 1756 cmd.exe WMIC.exe PID 1756 wrote to memory of 1220 1756 cmd.exe WMIC.exe PID 1756 wrote to memory of 1220 1756 cmd.exe WMIC.exe PID 1088 wrote to memory of 1668 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1668 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1668 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1088 wrote to memory of 1668 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe PID 1668 wrote to memory of 1596 1668 cmd.exe WMIC.exe PID 1668 wrote to memory of 1596 1668 cmd.exe WMIC.exe PID 1668 wrote to memory of 1596 1668 cmd.exe WMIC.exe PID 1088 wrote to memory of 1412 1088 eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe"C:\Users\Admin\AppData\Local\Temp\eacaab8d6520c9bf9dec6cbdffa7c4ad8c15fd57dd4165cf895a0aaae3ffe371.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E44615B8-B9B5-4870-9DD9-8A8542723199}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{84F4B8C3-25A2-4458-A56F-8519E36811F7}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{744FE292-20A5-4AFC-BD35-933034B0EF11}'" delete3⤵PID:1748
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A95C7851-06D0-4CCA-A3E1-B1F1626F096E}'" delete3⤵PID:1016
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{14A1A80C-9E7C-48D0-86C2-448827344C94}'" delete3⤵PID:1716
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{44676B88-09A9-4F29-B5AA-1A29E20A4F75}'" delete3⤵PID:1224
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A848EC9E-3173-4948-B6B3-92AA790A398D}'" delete3⤵PID:908
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{847CDF19-2016-4A38-AFDE-ACAACC042E32}'" delete3⤵PID:1220
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{149E22FF-26D8-4174-B024-D9A099D41A26}'" delete3⤵PID:1596
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete2⤵PID:1412
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7AB0E411-B327-4F16-BBD1-9AE4F37B7704}'" delete3⤵PID:676
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete2⤵PID:1832
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469B32FA-07FA-4E77-BD92-42CDE468BDF3}'" delete3⤵PID:1396
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete2⤵PID:1900
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6531F51C-FE63-4790-8958-D5812779895E}'" delete3⤵PID:1348
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete2⤵PID:1656
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{410940A4-BA5D-4F4E-B015-F25CD66FA904}'" delete3⤵PID:1784
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:548