Analysis
-
max time kernel
81s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-12-2022 17:44
Behavioral task
behavioral1
Sample
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe
-
Size
396KB
-
MD5
6a956731b3677dd9d4d18641d40532ab
-
SHA1
1994ee0b381c5528d5b5c01fb97a14b5ff81e5a5
-
SHA256
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309
-
SHA512
314d87605dfe01cfb83a8b6ff17e98fc933f012ef933557d1899ebf0941d892a37f0d0692d99a3cd7061ce6c2c90a6dafe7b8dbb80ae875d9c368529f0b87991
-
SSDEEP
1536:n28VgV1U8ZGURVFB3eH/omAhUfKQnSz+jS7ddpjHXSeSv3caALL95T:28VgV1UqGgVFBKo8ybdz
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\readme-warning.txt
Family
makop
Ransom Note
::: Greetings :::
Little FAQ:
.1.
Q: Whats Happen?
A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen.
.2.
Q: How to recover files?
A: If you wish to decrypt your files you will need to pay in bitcoins.
.3.
Q: What about guarantees?
A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests.
.4.
Q: How to contact with you?
A: You can write us to our mailbox: [email protected] or [email protected]
.5.
Q: How will the decryption process proceed after payment?
A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files.
.6.
Q: If I don�t want to pay bad people like you?
A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money.
:::BEWARE:::
DON'T try to change encrypted files by yourself!
If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files!
Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Signatures
-
Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
pid Process 1464 wbadmin.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DisableLimit.tiff dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ACTIVITS.ICO dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14801_.GIF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153087.WMF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieMergeLetter.dotx dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\INDST_01.MID dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02054_.WMF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\SettingsInternal.zip dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_settings.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mousedown.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\SETUP.XML dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.XML dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.[B8DC70B3].[[email protected]].makop dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\de-DE\msadcor.dll.mui dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\VelvetRose.css dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\SpiderSolitaire.exe.mui dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\MENUS.JS dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_OFF.GIF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Custom.propdesc dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\THMBNAIL.PNG dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02791_.WMF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMAIN.XML dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\THMBNAIL.PNG dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Paper.eftx dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\readme-warning.txt dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382944.JPG dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0295241.GIF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montreal dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0304861.WMF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01157_.WMF dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\TOOT.WAV dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLCFG32.CPL dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 592 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2020 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeBackupPrivilege 772 vssvc.exe Token: SeRestorePrivilege 772 vssvc.exe Token: SeAuditPrivilege 772 vssvc.exe Token: SeBackupPrivilege 816 wbengine.exe Token: SeRestorePrivilege 816 wbengine.exe Token: SeSecurityPrivilege 816 wbengine.exe Token: SeIncreaseQuotaPrivilege 676 WMIC.exe Token: SeSecurityPrivilege 676 WMIC.exe Token: SeTakeOwnershipPrivilege 676 WMIC.exe Token: SeLoadDriverPrivilege 676 WMIC.exe Token: SeSystemProfilePrivilege 676 WMIC.exe Token: SeSystemtimePrivilege 676 WMIC.exe Token: SeProfSingleProcessPrivilege 676 WMIC.exe Token: SeIncBasePriorityPrivilege 676 WMIC.exe Token: SeCreatePagefilePrivilege 676 WMIC.exe Token: SeBackupPrivilege 676 WMIC.exe Token: SeRestorePrivilege 676 WMIC.exe Token: SeShutdownPrivilege 676 WMIC.exe Token: SeDebugPrivilege 676 WMIC.exe Token: SeSystemEnvironmentPrivilege 676 WMIC.exe Token: SeRemoteShutdownPrivilege 676 WMIC.exe Token: SeUndockPrivilege 676 WMIC.exe Token: SeManageVolumePrivilege 676 WMIC.exe Token: 33 676 WMIC.exe Token: 34 676 WMIC.exe Token: 35 676 WMIC.exe Token: SeIncreaseQuotaPrivilege 676 WMIC.exe Token: SeSecurityPrivilege 676 WMIC.exe Token: SeTakeOwnershipPrivilege 676 WMIC.exe Token: SeLoadDriverPrivilege 676 WMIC.exe Token: SeSystemProfilePrivilege 676 WMIC.exe Token: SeSystemtimePrivilege 676 WMIC.exe Token: SeProfSingleProcessPrivilege 676 WMIC.exe Token: SeIncBasePriorityPrivilege 676 WMIC.exe Token: SeCreatePagefilePrivilege 676 WMIC.exe Token: SeBackupPrivilege 676 WMIC.exe Token: SeRestorePrivilege 676 WMIC.exe Token: SeShutdownPrivilege 676 WMIC.exe Token: SeDebugPrivilege 676 WMIC.exe Token: SeSystemEnvironmentPrivilege 676 WMIC.exe Token: SeRemoteShutdownPrivilege 676 WMIC.exe Token: SeUndockPrivilege 676 WMIC.exe Token: SeManageVolumePrivilege 676 WMIC.exe Token: 33 676 WMIC.exe Token: 34 676 WMIC.exe Token: 35 676 WMIC.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2020 wrote to memory of 604 2020 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe 27 PID 2020 wrote to memory of 604 2020 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe 27 PID 2020 wrote to memory of 604 2020 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe 27 PID 2020 wrote to memory of 604 2020 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe 27 PID 604 wrote to memory of 592 604 cmd.exe 29 PID 604 wrote to memory of 592 604 cmd.exe 29 PID 604 wrote to memory of 592 604 cmd.exe 29 PID 604 wrote to memory of 1464 604 cmd.exe 32 PID 604 wrote to memory of 1464 604 cmd.exe 32 PID 604 wrote to memory of 1464 604 cmd.exe 32 PID 604 wrote to memory of 676 604 cmd.exe 36 PID 604 wrote to memory of 676 604 cmd.exe 36 PID 604 wrote to memory of 676 604 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe"C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe"C:\Users\Admin\AppData\Local\Temp\dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309.exe" n20202⤵PID:1352
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:592
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
PID:1464
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:772
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:816
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1036
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1140