Analysis
-
max time kernel
39s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06/07/2022, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
-
Size
228KB
-
MD5
707c69692402945982492eede5c829ca
-
SHA1
1e2da40c770722385982f6f0a49a4920f69870ba
-
SHA256
b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8
-
SHA512
5373029d7fad0c36c0f7dfeaafddaf869c7f5f53d07b4b81e0af7a32764a7fd24299bdb05ea000efdc6c840b6e5f19613315fa1185d19161d7342a4b065e8164
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\#HOW_TO_DECRYPT#.txt
Ransom Note
ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED!
====================================================================================================
Your files are NOT damaged! Your files are modified only. This modification is reversible.
The only 1 way to decrypt your files is to receive the private key and decryption program.
Any attempts to restore your files with the third party software will be fatal for your files!
====================================================================================================
To receive the private key and decryption program follow the instructions below:
1. Write to our skype - RICARDOMILOS DECRYPTION
Also you can write ICQ live chat which works 24/7 @RicardoMilosGachimuchi
Install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ
Write to our ICQ @RicardoMilosGachimuchi https://icq.im/RicardoMilosGachimuchi
2. Our company values its reputation. We give all guarantees of your files decryption, such as test decryption some of them
We respect your time and waiting for respond from your side
tell your MachineID: 2913756387 and LaunchID: f1d3ffa752
====================================================================================================
URLs
https://icq.com/windows/
https://icq.im/RicardoMilosGachimuchi
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\OpenSync.tiff b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe File opened for modification C:\Users\Admin\Pictures\SwitchRead.tiff b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Deletes itself 1 IoCs
pid Process 1376 cmd.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1968 icacls.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFEEditor = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe\" e" b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\E:\$RECYCLE.BIN\S-1-5-21-790309383-526510583-3802439154-1000\desktop.ini b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\E: b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe -
Generic Ransomware Note 64 IoCs
Ransomware often writes a note containing information on how to pay the ransom.
yara_rule generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note generic_ransomware_note -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 916 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
pid Process 2036 timeout.exe -
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1696 vssadmin.exe 1968 vssadmin.exe 1368 vssadmin.exe 916 vssadmin.exe 1744 vssadmin.exe 556 vssadmin.exe 1588 vssadmin.exe 268 vssadmin.exe 684 vssadmin.exe 1624 vssadmin.exe 972 vssadmin.exe 1604 vssadmin.exe 996 vssadmin.exe 1600 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 580 powershell.exe 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
description pid Process Token: SeBackupPrivilege 1240 vssvc.exe Token: SeRestorePrivilege 1240 vssvc.exe Token: SeAuditPrivilege 1240 vssvc.exe Token: SeIncreaseQuotaPrivilege 560 wmic.exe Token: SeSecurityPrivilege 560 wmic.exe Token: SeTakeOwnershipPrivilege 560 wmic.exe Token: SeLoadDriverPrivilege 560 wmic.exe Token: SeSystemProfilePrivilege 560 wmic.exe Token: SeSystemtimePrivilege 560 wmic.exe Token: SeProfSingleProcessPrivilege 560 wmic.exe Token: SeIncBasePriorityPrivilege 560 wmic.exe Token: SeCreatePagefilePrivilege 560 wmic.exe Token: SeBackupPrivilege 560 wmic.exe Token: SeRestorePrivilege 560 wmic.exe Token: SeShutdownPrivilege 560 wmic.exe Token: SeDebugPrivilege 560 wmic.exe Token: SeSystemEnvironmentPrivilege 560 wmic.exe Token: SeRemoteShutdownPrivilege 560 wmic.exe Token: SeUndockPrivilege 560 wmic.exe Token: SeManageVolumePrivilege 560 wmic.exe Token: 33 560 wmic.exe Token: 34 560 wmic.exe Token: 35 560 wmic.exe Token: SeIncreaseQuotaPrivilege 560 wmic.exe Token: SeSecurityPrivilege 560 wmic.exe Token: SeTakeOwnershipPrivilege 560 wmic.exe Token: SeLoadDriverPrivilege 560 wmic.exe Token: SeSystemProfilePrivilege 560 wmic.exe Token: SeSystemtimePrivilege 560 wmic.exe Token: SeProfSingleProcessPrivilege 560 wmic.exe Token: SeIncBasePriorityPrivilege 560 wmic.exe Token: SeCreatePagefilePrivilege 560 wmic.exe Token: SeBackupPrivilege 560 wmic.exe Token: SeRestorePrivilege 560 wmic.exe Token: SeShutdownPrivilege 560 wmic.exe Token: SeDebugPrivilege 560 wmic.exe Token: SeSystemEnvironmentPrivilege 560 wmic.exe Token: SeRemoteShutdownPrivilege 560 wmic.exe Token: SeUndockPrivilege 560 wmic.exe Token: SeManageVolumePrivilege 560 wmic.exe Token: 33 560 wmic.exe Token: 34 560 wmic.exe Token: 35 560 wmic.exe Token: SeDebugPrivilege 580 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 1628 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 26 PID 1868 wrote to memory of 1628 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 26 PID 1868 wrote to memory of 1628 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 26 PID 1868 wrote to memory of 1628 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 26 PID 1868 wrote to memory of 1696 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 27 PID 1868 wrote to memory of 1696 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 27 PID 1868 wrote to memory of 1696 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 27 PID 1868 wrote to memory of 1696 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 27 PID 1628 wrote to memory of 1604 1628 net.exe 30 PID 1628 wrote to memory of 1604 1628 net.exe 30 PID 1628 wrote to memory of 1604 1628 net.exe 30 PID 1628 wrote to memory of 1604 1628 net.exe 30 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 32 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 32 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 32 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 32 PID 1868 wrote to memory of 560 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 34 PID 1868 wrote to memory of 560 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 34 PID 1868 wrote to memory of 560 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 34 PID 1868 wrote to memory of 560 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 34 PID 1868 wrote to memory of 1968 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 37 PID 1868 wrote to memory of 1968 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 37 PID 1868 wrote to memory of 1968 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 37 PID 1868 wrote to memory of 1968 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 37 PID 1868 wrote to memory of 972 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 39 PID 1868 wrote to memory of 972 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 39 PID 1868 wrote to memory of 972 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 39 PID 1868 wrote to memory of 972 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 39 PID 1868 wrote to memory of 268 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 41 PID 1868 wrote to memory of 268 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 41 PID 1868 wrote to memory of 268 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 41 PID 1868 wrote to memory of 268 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 41 PID 1868 wrote to memory of 1368 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 43 PID 1868 wrote to memory of 1368 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 43 PID 1868 wrote to memory of 1368 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 43 PID 1868 wrote to memory of 1368 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 43 PID 1868 wrote to memory of 684 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 45 PID 1868 wrote to memory of 684 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 45 PID 1868 wrote to memory of 684 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 45 PID 1868 wrote to memory of 684 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 45 PID 1868 wrote to memory of 1624 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 47 PID 1868 wrote to memory of 1624 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 47 PID 1868 wrote to memory of 1624 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 47 PID 1868 wrote to memory of 1624 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 47 PID 1868 wrote to memory of 556 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 49 PID 1868 wrote to memory of 556 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 49 PID 1868 wrote to memory of 556 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 49 PID 1868 wrote to memory of 556 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 49 PID 1868 wrote to memory of 1588 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 51 PID 1868 wrote to memory of 1588 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 51 PID 1868 wrote to memory of 1588 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 51 PID 1868 wrote to memory of 1588 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 51 PID 1868 wrote to memory of 1604 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 53 PID 1868 wrote to memory of 1604 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 53 PID 1868 wrote to memory of 1604 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 53 PID 1868 wrote to memory of 1604 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 53 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 55 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 55 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 55 PID 1868 wrote to memory of 916 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 55 PID 1868 wrote to memory of 996 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 57 PID 1868 wrote to memory of 996 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 57 PID 1868 wrote to memory of 996 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 57 PID 1868 wrote to memory of 996 1868 b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe 57 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe"C:\Users\Admin\AppData\Local\Temp\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1868 -
C:\Windows\SysWOW64\net.exenet stop VSS & sc config VSS start= disabled2⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VSS & sc config VSS start= disabled3⤵PID:1604
-
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1696
-
-
C:\Windows\SysWOW64\sc.exesc config VSS start= Demand & net start VSS2⤵
- Launches sc.exe
PID:916
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY delete /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1968
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=401MB2⤵
- Interacts with shadow copies
PID:972
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded2⤵
- Interacts with shadow copies
PID:268
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1368
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:684
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1624
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:556
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1588
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1604
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:916
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:996
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=401MB2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1600
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded2⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1744
-
-
C:\Windows\SysWOW64\icacls.exeicacls.exe "{A-Z}:" /grant {Username}:F /T /C /Q2⤵
- Modifies file permissions
PID:1968
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout 1 && del "C:\Users\Admin\AppData\Local\Temp\b236068ab96144198a99444a0c8c4ea42e8cde9667e56e8e1402de8a4030ebe8.exe" >> NUL2⤵
- Deletes itself
PID:1376 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:2036
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240