Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-09-2022 09:44
Behavioral task
behavioral1
Sample
a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
-
Size
669KB
-
MD5
225fef16f054c69c11dfc5a22007c650
-
SHA1
9ee3f21f5d6c9266c0a368bfa60076715dff6ed9
-
SHA256
a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
-
SHA512
b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DbKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HW6KrKe
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
resource yara_rule behavioral1/files/0x00140000000054ab-61.dat family_medusalocker behavioral1/files/0x00140000000054ab-63.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1100 svhost.exe -
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\BlockClose.png => C:\Users\Admin\Pictures\BlockClose.png.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File renamed C:\Users\Admin\Pictures\ResolveSync.crw => C:\Users\Admin\Pictures\ResolveSync.crw.netlock8 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-2292972927-2705560509-2768824231-1000\desktop.ini a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\R: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\T: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\X: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\B: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\G: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\H: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\N: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\S: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\Y: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\A: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\E: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\K: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\L: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\P: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\V: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\W: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\Z: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\F: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\I: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\J: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\M: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\Q: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe File opened (read-only) \??\U: a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 904 vssadmin.exe 1700 vssadmin.exe 340 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 1372 vssvc.exe Token: SeRestorePrivilege 1372 vssvc.exe Token: SeAuditPrivilege 1372 vssvc.exe Token: SeIncreaseQuotaPrivilege 1012 wmic.exe Token: SeSecurityPrivilege 1012 wmic.exe Token: SeTakeOwnershipPrivilege 1012 wmic.exe Token: SeLoadDriverPrivilege 1012 wmic.exe Token: SeSystemProfilePrivilege 1012 wmic.exe Token: SeSystemtimePrivilege 1012 wmic.exe Token: SeProfSingleProcessPrivilege 1012 wmic.exe Token: SeIncBasePriorityPrivilege 1012 wmic.exe Token: SeCreatePagefilePrivilege 1012 wmic.exe Token: SeBackupPrivilege 1012 wmic.exe Token: SeRestorePrivilege 1012 wmic.exe Token: SeShutdownPrivilege 1012 wmic.exe Token: SeDebugPrivilege 1012 wmic.exe Token: SeSystemEnvironmentPrivilege 1012 wmic.exe Token: SeRemoteShutdownPrivilege 1012 wmic.exe Token: SeUndockPrivilege 1012 wmic.exe Token: SeManageVolumePrivilege 1012 wmic.exe Token: 33 1012 wmic.exe Token: 34 1012 wmic.exe Token: 35 1012 wmic.exe Token: SeIncreaseQuotaPrivilege 636 wmic.exe Token: SeSecurityPrivilege 636 wmic.exe Token: SeTakeOwnershipPrivilege 636 wmic.exe Token: SeLoadDriverPrivilege 636 wmic.exe Token: SeSystemProfilePrivilege 636 wmic.exe Token: SeSystemtimePrivilege 636 wmic.exe Token: SeProfSingleProcessPrivilege 636 wmic.exe Token: SeIncBasePriorityPrivilege 636 wmic.exe Token: SeCreatePagefilePrivilege 636 wmic.exe Token: SeBackupPrivilege 636 wmic.exe Token: SeRestorePrivilege 636 wmic.exe Token: SeShutdownPrivilege 636 wmic.exe Token: SeDebugPrivilege 636 wmic.exe Token: SeSystemEnvironmentPrivilege 636 wmic.exe Token: SeRemoteShutdownPrivilege 636 wmic.exe Token: SeUndockPrivilege 636 wmic.exe Token: SeManageVolumePrivilege 636 wmic.exe Token: 33 636 wmic.exe Token: 34 636 wmic.exe Token: 35 636 wmic.exe Token: SeIncreaseQuotaPrivilege 1920 wmic.exe Token: SeSecurityPrivilege 1920 wmic.exe Token: SeTakeOwnershipPrivilege 1920 wmic.exe Token: SeLoadDriverPrivilege 1920 wmic.exe Token: SeSystemProfilePrivilege 1920 wmic.exe Token: SeSystemtimePrivilege 1920 wmic.exe Token: SeProfSingleProcessPrivilege 1920 wmic.exe Token: SeIncBasePriorityPrivilege 1920 wmic.exe Token: SeCreatePagefilePrivilege 1920 wmic.exe Token: SeBackupPrivilege 1920 wmic.exe Token: SeRestorePrivilege 1920 wmic.exe Token: SeShutdownPrivilege 1920 wmic.exe Token: SeDebugPrivilege 1920 wmic.exe Token: SeSystemEnvironmentPrivilege 1920 wmic.exe Token: SeRemoteShutdownPrivilege 1920 wmic.exe Token: SeUndockPrivilege 1920 wmic.exe Token: SeManageVolumePrivilege 1920 wmic.exe Token: 33 1920 wmic.exe Token: 34 1920 wmic.exe Token: 35 1920 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 896 wrote to memory of 904 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 27 PID 896 wrote to memory of 904 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 27 PID 896 wrote to memory of 904 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 27 PID 896 wrote to memory of 904 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 27 PID 896 wrote to memory of 1012 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 30 PID 896 wrote to memory of 1012 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 30 PID 896 wrote to memory of 1012 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 30 PID 896 wrote to memory of 1012 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 30 PID 896 wrote to memory of 1700 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 32 PID 896 wrote to memory of 1700 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 32 PID 896 wrote to memory of 1700 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 32 PID 896 wrote to memory of 1700 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 32 PID 896 wrote to memory of 636 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 34 PID 896 wrote to memory of 636 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 34 PID 896 wrote to memory of 636 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 34 PID 896 wrote to memory of 636 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 34 PID 896 wrote to memory of 340 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 36 PID 896 wrote to memory of 340 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 36 PID 896 wrote to memory of 340 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 36 PID 896 wrote to memory of 340 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 36 PID 896 wrote to memory of 1920 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 38 PID 896 wrote to memory of 1920 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 38 PID 896 wrote to memory of 1920 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 38 PID 896 wrote to memory of 1920 896 a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe 38 PID 776 wrote to memory of 1100 776 taskeng.exe 43 PID 776 wrote to memory of 1100 776 taskeng.exe 43 PID 776 wrote to memory of 1100 776 taskeng.exe 43 PID 776 wrote to memory of 1100 776 taskeng.exe 43 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe"C:\Users\Admin\AppData\Local\Temp\a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf.exe"1⤵
- UAC bypass
- Modifies extensions of user files
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:896 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:904
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1700
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:636
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:340
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
C:\Windows\system32\taskeng.exetaskeng.exe {BCC3F42F-B3F0-4A5A-A74A-718F773CA492} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1100
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD5225fef16f054c69c11dfc5a22007c650
SHA19ee3f21f5d6c9266c0a368bfa60076715dff6ed9
SHA256a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
SHA512b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c
-
Filesize
669KB
MD5225fef16f054c69c11dfc5a22007c650
SHA19ee3f21f5d6c9266c0a368bfa60076715dff6ed9
SHA256a5fdfacc22914d12eec28fb085f026401db10ae51d4e549dfec6160501be0dcf
SHA512b20f3ce34675078174085537f982fb7702d90fefead38481ad3a3d8b34c591c4a4ae8c24fb95810b79ed71427044d2ccf501cb095e6edc64bf673400c7bd584c