Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 08:20
Behavioral task
behavioral1
Sample
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
-
Size
669KB
-
MD5
87fc357cfaa43f6766a5efef072871bc
-
SHA1
ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
-
SHA256
6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
-
SHA512
2fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436
-
SSDEEP
12288:dQA0FfTcwpBuV2UxqDmuiLZeUaoFi2XZWfGe615HhAZV8DhKD/KeX:Tuf4wTuV2Ux3uIZeUBi2Te6HWIKrKe
Score
10/10
Malware Config
Signatures
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000005c50-61.dat family_medusalocker behavioral1/files/0x0007000000005c50-63.dat family_medusalocker -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 1216 svhost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-999675638-2867687379-27515722-1000\desktop.ini 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\S: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\V: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\W: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\J: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\O: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\T: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\X: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\L: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\Q: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\G: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\I: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\K: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\P: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\U: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\Y: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\A: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\E: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\Z: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\H: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\M: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\N: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\B: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe File opened (read-only) \??\F: 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1860 vssadmin.exe 636 vssadmin.exe 1288 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeBackupPrivilege 856 vssvc.exe Token: SeRestorePrivilege 856 vssvc.exe Token: SeAuditPrivilege 856 vssvc.exe Token: SeIncreaseQuotaPrivilege 1928 wmic.exe Token: SeSecurityPrivilege 1928 wmic.exe Token: SeTakeOwnershipPrivilege 1928 wmic.exe Token: SeLoadDriverPrivilege 1928 wmic.exe Token: SeSystemProfilePrivilege 1928 wmic.exe Token: SeSystemtimePrivilege 1928 wmic.exe Token: SeProfSingleProcessPrivilege 1928 wmic.exe Token: SeIncBasePriorityPrivilege 1928 wmic.exe Token: SeCreatePagefilePrivilege 1928 wmic.exe Token: SeBackupPrivilege 1928 wmic.exe Token: SeRestorePrivilege 1928 wmic.exe Token: SeShutdownPrivilege 1928 wmic.exe Token: SeDebugPrivilege 1928 wmic.exe Token: SeSystemEnvironmentPrivilege 1928 wmic.exe Token: SeRemoteShutdownPrivilege 1928 wmic.exe Token: SeUndockPrivilege 1928 wmic.exe Token: SeManageVolumePrivilege 1928 wmic.exe Token: 33 1928 wmic.exe Token: 34 1928 wmic.exe Token: 35 1928 wmic.exe Token: SeIncreaseQuotaPrivilege 1736 wmic.exe Token: SeSecurityPrivilege 1736 wmic.exe Token: SeTakeOwnershipPrivilege 1736 wmic.exe Token: SeLoadDriverPrivilege 1736 wmic.exe Token: SeSystemProfilePrivilege 1736 wmic.exe Token: SeSystemtimePrivilege 1736 wmic.exe Token: SeProfSingleProcessPrivilege 1736 wmic.exe Token: SeIncBasePriorityPrivilege 1736 wmic.exe Token: SeCreatePagefilePrivilege 1736 wmic.exe Token: SeBackupPrivilege 1736 wmic.exe Token: SeRestorePrivilege 1736 wmic.exe Token: SeShutdownPrivilege 1736 wmic.exe Token: SeDebugPrivilege 1736 wmic.exe Token: SeSystemEnvironmentPrivilege 1736 wmic.exe Token: SeRemoteShutdownPrivilege 1736 wmic.exe Token: SeUndockPrivilege 1736 wmic.exe Token: SeManageVolumePrivilege 1736 wmic.exe Token: 33 1736 wmic.exe Token: 34 1736 wmic.exe Token: 35 1736 wmic.exe Token: SeIncreaseQuotaPrivilege 860 wmic.exe Token: SeSecurityPrivilege 860 wmic.exe Token: SeTakeOwnershipPrivilege 860 wmic.exe Token: SeLoadDriverPrivilege 860 wmic.exe Token: SeSystemProfilePrivilege 860 wmic.exe Token: SeSystemtimePrivilege 860 wmic.exe Token: SeProfSingleProcessPrivilege 860 wmic.exe Token: SeIncBasePriorityPrivilege 860 wmic.exe Token: SeCreatePagefilePrivilege 860 wmic.exe Token: SeBackupPrivilege 860 wmic.exe Token: SeRestorePrivilege 860 wmic.exe Token: SeShutdownPrivilege 860 wmic.exe Token: SeDebugPrivilege 860 wmic.exe Token: SeSystemEnvironmentPrivilege 860 wmic.exe Token: SeRemoteShutdownPrivilege 860 wmic.exe Token: SeUndockPrivilege 860 wmic.exe Token: SeManageVolumePrivilege 860 wmic.exe Token: 33 860 wmic.exe Token: 34 860 wmic.exe Token: 35 860 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1184 wrote to memory of 1860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 26 PID 1184 wrote to memory of 1860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 26 PID 1184 wrote to memory of 1860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 26 PID 1184 wrote to memory of 1860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 26 PID 1184 wrote to memory of 1928 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 29 PID 1184 wrote to memory of 1928 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 29 PID 1184 wrote to memory of 1928 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 29 PID 1184 wrote to memory of 1928 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 29 PID 1184 wrote to memory of 636 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 31 PID 1184 wrote to memory of 636 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 31 PID 1184 wrote to memory of 636 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 31 PID 1184 wrote to memory of 636 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 31 PID 1184 wrote to memory of 1736 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 33 PID 1184 wrote to memory of 1736 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 33 PID 1184 wrote to memory of 1736 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 33 PID 1184 wrote to memory of 1736 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 33 PID 1184 wrote to memory of 1288 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 35 PID 1184 wrote to memory of 1288 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 35 PID 1184 wrote to memory of 1288 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 35 PID 1184 wrote to memory of 1288 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 35 PID 1184 wrote to memory of 860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 37 PID 1184 wrote to memory of 860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 37 PID 1184 wrote to memory of 860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 37 PID 1184 wrote to memory of 860 1184 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe 37 PID 768 wrote to memory of 1216 768 taskeng.exe 40 PID 768 wrote to memory of 1216 768 taskeng.exe 40 PID 768 wrote to memory of 1216 768 taskeng.exe 40 PID 768 wrote to memory of 1216 768 taskeng.exe 40 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe"C:\Users\Admin\AppData\Local\Temp\6cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1184 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1860
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:636
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:1288
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:856
-
C:\Windows\system32\taskeng.exetaskeng.exe {57D0D0DF-FD11-4A44-A984-4674ACC26BC0} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe2⤵
- Executes dropped EXE
PID:1216
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD587fc357cfaa43f6766a5efef072871bc
SHA1ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
SHA2566cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
SHA5122fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436
-
Filesize
669KB
MD587fc357cfaa43f6766a5efef072871bc
SHA1ab77612d19ab9ec9f3bff9f13bf18cffc82799a7
SHA2566cd8d4ae87a7c260ea6e16403fa761281d3073f466cc0217951d978c17020d2a
SHA5122fbe4934c1d5485d12d4a395668778e765de66ec44afd06f8d702427dac7f8de13f4b3f954ef95f7f5cb27f6bc8f1db4933b56babfa6bab1575a66dfede5c436