buran | 56871e1fe3b6af154aadd2ab300f0bfc031aea4fab992dbaec57057459a0d754

Analysis

max time kernel
105s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-10-2022 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

211KB
MD5

298dcc1285045bc397ef95ec583901da
SHA1

0b983d8948b282a76bece44d61e9ac73f10cfd31
SHA256

56871e1fe3b6af154aadd2ab300f0bfc031aea4fab992dbaec57057459a0d754
SHA512

ef296ab179f5578d51ccbbe6b9194e1bd3fd46affa3a14be955e15994b6e902c01b467a962eb0d3548fe510f16c77c73d87bece92b15bc6f89c3e2dd4ffea94a
SSDEEP

6144:gia1gMHOPDWIhID8X/4DQFu/U3buRKlemZ9DnGAetTsB+U+:gIMH06cID84DQFu/U3buRKlemZ9DnGAI

Score

10^/10

buran zeppelin persistence ransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 555-B4B-BE1 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran

Detects Zeppelin payload 5 IoCs

resource	yara_rule
behavioral1/files/0x00150000000054ab-55.dat	family_zeppelin
behavioral1/files/0x00150000000054ab-56.dat	family_zeppelin
behavioral1/files/0x00150000000054ab-58.dat	family_zeppelin
behavioral1/files/0x00150000000054ab-72.dat	family_zeppelin
behavioral1/files/0x00150000000054ab-74.dat	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 2 IoCs

pid	Process
1804	smss.exe
1548	smss.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ApproveUnpublish.tiff	smss.exe
File opened for modification	C:\Users\Admin\Pictures\EnableMerge.tiff	smss.exe
File opened for modification	C:\Users\Admin\Pictures\PopSplit.tiff	smss.exe

Deletes itself 1 IoCs

pid	Process
1076	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
1948	1.exe
1948	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\smss.exe\" -start"	1.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	smss.exe
File opened (read-only)	\??\X:	smss.exe
File opened (read-only)	\??\V:	smss.exe
File opened (read-only)	\??\S:	smss.exe
File opened (read-only)	\??\N:	smss.exe
File opened (read-only)	\??\I:	smss.exe
File opened (read-only)	\??\H:	smss.exe
File opened (read-only)	\??\U:	smss.exe
File opened (read-only)	\??\R:	smss.exe
File opened (read-only)	\??\Q:	smss.exe
File opened (read-only)	\??\P:	smss.exe
File opened (read-only)	\??\E:	smss.exe
File opened (read-only)	\??\G:	smss.exe
File opened (read-only)	\??\F:	smss.exe
File opened (read-only)	\??\Z:	smss.exe
File opened (read-only)	\??\W:	smss.exe
File opened (read-only)	\??\T:	smss.exe
File opened (read-only)	\??\O:	smss.exe
File opened (read-only)	\??\M:	smss.exe
File opened (read-only)	\??\J:	smss.exe
File opened (read-only)	\??\Y:	smss.exe
File opened (read-only)	\??\L:	smss.exe
File opened (read-only)	\??\K:	smss.exe
File opened (read-only)	\??\B:	smss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID	smss.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\HEADINGBB.POC.555-B4B-BE1	smss.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\SessionOwner.ico.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	smss.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01084_.WMF	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF	smss.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309902.WMF	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue.css.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF	smss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04384_.WMF	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSSPC.ECF.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar	smss.exe
File created	C:\Program Files\VideoLAN\VLC\lua\extensions\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\WIND.WAV.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199805.WMF.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novosibirsk	smss.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00192_.WMF.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50B.GIF.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR51B.GIF	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBHED98.POC.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157177.WMF	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDRESN.CFG	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau	smss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Warsaw.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Sales Pipeline.accdt.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21480_.GIF	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086428.WMF	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL010.XML.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.XML.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar	smss.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\TexturedBlue.css	smss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	smss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties	smss.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst.555-B4B-BE1	smss.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay	smss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1648	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	1.exe
Token: SeDebugPrivilege	1948	1.exe
Token: SeDebugPrivilege	1804	smss.exe
Token: SeIncreaseQuotaPrivilege	396	WMIC.exe
Token: SeSecurityPrivilege	396	WMIC.exe
Token: SeTakeOwnershipPrivilege	396	WMIC.exe
Token: SeLoadDriverPrivilege	396	WMIC.exe
Token: SeSystemProfilePrivilege	396	WMIC.exe
Token: SeSystemtimePrivilege	396	WMIC.exe
Token: SeProfSingleProcessPrivilege	396	WMIC.exe
Token: SeIncBasePriorityPrivilege	396	WMIC.exe
Token: SeCreatePagefilePrivilege	396	WMIC.exe
Token: SeBackupPrivilege	396	WMIC.exe
Token: SeRestorePrivilege	396	WMIC.exe
Token: SeShutdownPrivilege	396	WMIC.exe
Token: SeDebugPrivilege	396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	396	WMIC.exe
Token: SeRemoteShutdownPrivilege	396	WMIC.exe
Token: SeUndockPrivilege	396	WMIC.exe
Token: SeManageVolumePrivilege	396	WMIC.exe
Token: 33	396	WMIC.exe
Token: 34	396	WMIC.exe
Token: 35	396	WMIC.exe
Token: SeIncreaseQuotaPrivilege	396	WMIC.exe
Token: SeSecurityPrivilege	396	WMIC.exe
Token: SeTakeOwnershipPrivilege	396	WMIC.exe
Token: SeLoadDriverPrivilege	396	WMIC.exe
Token: SeSystemProfilePrivilege	396	WMIC.exe
Token: SeSystemtimePrivilege	396	WMIC.exe
Token: SeProfSingleProcessPrivilege	396	WMIC.exe
Token: SeIncBasePriorityPrivilege	396	WMIC.exe
Token: SeCreatePagefilePrivilege	396	WMIC.exe
Token: SeBackupPrivilege	396	WMIC.exe
Token: SeRestorePrivilege	396	WMIC.exe
Token: SeShutdownPrivilege	396	WMIC.exe
Token: SeDebugPrivilege	396	WMIC.exe
Token: SeSystemEnvironmentPrivilege	396	WMIC.exe
Token: SeRemoteShutdownPrivilege	396	WMIC.exe
Token: SeUndockPrivilege	396	WMIC.exe
Token: SeManageVolumePrivilege	396	WMIC.exe
Token: 33	396	WMIC.exe
Token: 34	396	WMIC.exe
Token: 35	396	WMIC.exe
Token: SeBackupPrivilege	1852	vssvc.exe
Token: SeRestorePrivilege	1852	vssvc.exe
Token: SeAuditPrivilege	1852	vssvc.exe
Token: SeDebugPrivilege	1804	smss.exe
Token: SeDebugPrivilege	1804	smss.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1804	1948	1.exe	27
PID 1948 wrote to memory of 1804	1948	1.exe	27
PID 1948 wrote to memory of 1804	1948	1.exe	27
PID 1948 wrote to memory of 1804	1948	1.exe	27
PID 1948 wrote to memory of 1076	1948	1.exe	28
PID 1948 wrote to memory of 1076	1948	1.exe	28
PID 1948 wrote to memory of 1076	1948	1.exe	28
PID 1948 wrote to memory of 1076	1948	1.exe	28
PID 1948 wrote to memory of 1076	1948	1.exe	28
PID 1948 wrote to memory of 1076	1948	1.exe	28
PID 1948 wrote to memory of 1076	1948	1.exe	28
PID 1804 wrote to memory of 2012	1804	smss.exe	29
PID 1804 wrote to memory of 2012	1804	smss.exe	29
PID 1804 wrote to memory of 2012	1804	smss.exe	29
PID 1804 wrote to memory of 2012	1804	smss.exe	29
PID 1804 wrote to memory of 2004	1804	smss.exe	31
PID 1804 wrote to memory of 2004	1804	smss.exe	31
PID 1804 wrote to memory of 2004	1804	smss.exe	31
PID 1804 wrote to memory of 2004	1804	smss.exe	31
PID 1804 wrote to memory of 1972	1804	smss.exe	33
PID 1804 wrote to memory of 1972	1804	smss.exe	33
PID 1804 wrote to memory of 1972	1804	smss.exe	33
PID 1804 wrote to memory of 1972	1804	smss.exe	33
PID 1804 wrote to memory of 568	1804	smss.exe	35
PID 1804 wrote to memory of 568	1804	smss.exe	35
PID 1804 wrote to memory of 568	1804	smss.exe	35
PID 1804 wrote to memory of 568	1804	smss.exe	35
PID 1804 wrote to memory of 1124	1804	smss.exe	37
PID 1804 wrote to memory of 1124	1804	smss.exe	37
PID 1804 wrote to memory of 1124	1804	smss.exe	37
PID 1804 wrote to memory of 1124	1804	smss.exe	37
PID 1804 wrote to memory of 1084	1804	smss.exe	39
PID 1804 wrote to memory of 1084	1804	smss.exe	39
PID 1804 wrote to memory of 1084	1804	smss.exe	39
PID 1804 wrote to memory of 1084	1804	smss.exe	39
PID 1804 wrote to memory of 1072	1804	smss.exe	41
PID 1804 wrote to memory of 1072	1804	smss.exe	41
PID 1804 wrote to memory of 1072	1804	smss.exe	41
PID 1804 wrote to memory of 1072	1804	smss.exe	41
PID 1072 wrote to memory of 396	1072	cmd.exe	43
PID 1072 wrote to memory of 396	1072	cmd.exe	43
PID 1072 wrote to memory of 396	1072	cmd.exe	43
PID 1072 wrote to memory of 396	1072	cmd.exe	43
PID 1804 wrote to memory of 1412	1804	smss.exe	46
PID 1804 wrote to memory of 1412	1804	smss.exe	46
PID 1804 wrote to memory of 1412	1804	smss.exe	46
PID 1804 wrote to memory of 1412	1804	smss.exe	46
PID 1412 wrote to memory of 1648	1412	cmd.exe	48
PID 1412 wrote to memory of 1648	1412	cmd.exe	48
PID 1412 wrote to memory of 1648	1412	cmd.exe	48
PID 1412 wrote to memory of 1648	1412	cmd.exe	48
PID 1804 wrote to memory of 1548	1804	smss.exe	49
PID 1804 wrote to memory of 1548	1804	smss.exe	49
PID 1804 wrote to memory of 1548	1804	smss.exe	49
PID 1804 wrote to memory of 1548	1804	smss.exe	49
PID 1804 wrote to memory of 1732	1804	smss.exe	50
PID 1804 wrote to memory of 1732	1804	smss.exe	50
PID 1804 wrote to memory of 1732	1804	smss.exe	50
PID 1804 wrote to memory of 1732	1804	smss.exe	50
PID 1804 wrote to memory of 1732	1804	smss.exe	50
PID 1804 wrote to memory of 1732	1804	smss.exe	50
PID 1804 wrote to memory of 1732	1804	smss.exe	50

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe" -start
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
    3⤵
    PID:568
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:396
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1648
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\smss.exe" -agent 0
    3⤵
    - Executes dropped EXE
    - Modifies extensions of user files
    - Drops file in Program Files directory
    PID:1548
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:1732
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Deletes itself
  PID:1076

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact