Analysis
-
max time kernel
4294177s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
06-03-2022 01:52
Static task
static1
Behavioral task
behavioral1
Sample
91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe
Resource
win10v2004-en-20220113
General
-
Target
91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe
-
Size
4.6MB
-
MD5
1d8710fba67b6869c39e236680693173
-
SHA1
813915a095895988679753cb6d7248eaf9dd00be
-
SHA256
91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553
-
SHA512
a316da3f52c509f0f595b93faf047ce56e9721795fe1f1e76aa0045225f8d412cb8718025f7501fa6b97616990fcbe01d240ec4d1c78ab62e8a652a7627d99f9
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW TO RESTORE YOUR FILES.TXT
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\RequestSubmit.png.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\RestoreRevoke.tiff 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File renamed C:\Users\Admin\Pictures\AddGroup.tiff => C:\Users\Admin\Pictures\AddGroup.tiff.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\AddGroup.tiff.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File renamed C:\Users\Admin\Pictures\ConnectBlock.crw => C:\Users\Admin\Pictures\ConnectBlock.crw.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File renamed C:\Users\Admin\Pictures\RequestSubmit.png => C:\Users\Admin\Pictures\RequestSubmit.png.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File renamed C:\Users\Admin\Pictures\RestoreRevoke.tiff => C:\Users\Admin\Pictures\RestoreRevoke.tiff.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\AddGroup.tiff 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File renamed C:\Users\Admin\Pictures\CompletePush.raw => C:\Users\Admin\Pictures\CompletePush.raw.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\CompletePush.raw.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\BlockSync.tiff 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File renamed C:\Users\Admin\Pictures\BlockSync.tiff => C:\Users\Admin\Pictures\BlockSync.tiff.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\BlockSync.tiff.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\ConnectBlock.crw.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Users\Admin\Pictures\RestoreRevoke.tiff.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO RESTORE YOUR FILES.TXT 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188519.WMF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00629_.WMF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\MST 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152694.WMF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Resolute 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01213K.JPG.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\security\java.security 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Hiring Requisition.fdt 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AssemblyInfoInternal.zip 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\HOW TO RESTORE YOUR FILES.TXT 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_COL.HXC 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXC 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01751_.GIF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01297_.GIF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00191_.WMF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OMML2MML.XSL.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199475.WMF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02169_.WMF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-cli.xml.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT98.POC 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\da.pak.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\HEADER.GIF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01329_.WMF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\ONLINE.ICO 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\profile.jfc 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\HOW TO RESTORE YOUR FILES.TXT 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.pb_2.3.5.v201404071733.jar.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195384.WMF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.SharePoint.BusinessData.Administration.Client.xml.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00559_.WMF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2F.GIF 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\HOW TO RESTORE YOUR FILES.TXT 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx.cwkkbzomdxj 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1792 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1568 vssvc.exe Token: SeRestorePrivilege 1568 vssvc.exe Token: SeAuditPrivilege 1568 vssvc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1668 wrote to memory of 980 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 27 PID 1668 wrote to memory of 980 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 27 PID 1668 wrote to memory of 980 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 27 PID 980 wrote to memory of 1144 980 cmd.exe 29 PID 980 wrote to memory of 1144 980 cmd.exe 29 PID 980 wrote to memory of 1144 980 cmd.exe 29 PID 980 wrote to memory of 576 980 cmd.exe 30 PID 980 wrote to memory of 576 980 cmd.exe 30 PID 980 wrote to memory of 576 980 cmd.exe 30 PID 1668 wrote to memory of 1344 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 31 PID 1668 wrote to memory of 1344 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 31 PID 1668 wrote to memory of 1344 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 31 PID 1668 wrote to memory of 984 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 34 PID 1668 wrote to memory of 984 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 34 PID 1668 wrote to memory of 984 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 34 PID 984 wrote to memory of 1792 984 cmd.exe 36 PID 984 wrote to memory of 1792 984 cmd.exe 36 PID 984 wrote to memory of 1792 984 cmd.exe 36 PID 1668 wrote to memory of 1072 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 40 PID 1668 wrote to memory of 1072 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 40 PID 1668 wrote to memory of 1072 1668 91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe"C:\Users\Admin\AppData\Local\Temp\91fe89eafca829107a5e80c6f7e875d72dbbfde7441961d6168709f5a42b4553.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\uldysykn.bat2⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\system32\sc.exeSC QUERY3⤵PID:1144
-
-
C:\Windows\system32\findstr.exeFINDSTR SERVICE_NAME3⤵PID:576
-
-
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\rdshpjakjorkshltt.bat2⤵PID:1344
-
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\qigwob.bat2⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1792
-
-
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\fmoseqmmdjtswot.bat2⤵PID:1072
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568