56e8399a61644e1ec4324caa8a99313d383c667f5296a9ed4f975a41590fe00b

pid	Process
616	bcdedit.exe
3224	bcdedit.exe

Deletes System State backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command-Line Interface

T1059

File Deletion

Inhibit System Recovery

pid	Process
4824	wbadmin.exe
3356	wbadmin.exe

Deletes system backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command-Line Interface

T1059

File Deletion

Inhibit System Recovery

pid	Process
4960	wbadmin.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\JoinSave.raw => C:\Users\Admin\Pictures\JoinSave.raw.cipher3	64new_cip3.exe
File renamed	C:\Users\Admin\Pictures\MountClear.tiff => C:\Users\Admin\Pictures\MountClear.tiff.cipher3	64new_cip3.exe
File renamed	C:\Users\Admin\Pictures\RenameUnlock.crw => C:\Users\Admin\Pictures\RenameUnlock.crw.cipher3	64new_cip3.exe
File opened for modification	C:\Users\Admin\Pictures\DisconnectEdit.tiff	64new_cip3.exe
File renamed	C:\Users\Admin\Pictures\CompleteEnable.raw => C:\Users\Admin\Pictures\CompleteEnable.raw.cipher3	64new_cip3.exe
File renamed	C:\Users\Admin\Pictures\EditRequest.png => C:\Users\Admin\Pictures\EditRequest.png.cipher3	64new_cip3.exe
File opened for modification	C:\Users\Admin\Pictures\MountClear.tiff	64new_cip3.exe
File renamed	C:\Users\Admin\Pictures\BackupSplit.tif => C:\Users\Admin\Pictures\BackupSplit.tif.cipher3	64new_cip3.exe
File renamed	C:\Users\Admin\Pictures\DisconnectEdit.tiff => C:\Users\Admin\Pictures\DisconnectEdit.tiff.cipher3	64new_cip3.exe
File renamed	C:\Users\Admin\Pictures\GroupMeasure.crw => C:\Users\Admin\Pictures\GroupMeasure.crw.cipher3	64new_cip3.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	64new_cip3.exe
File opened (read-only)	\??\W:	64new_cip3.exe
File opened (read-only)	\??\I:	64new_cip3.exe
File opened (read-only)	\??\N:	64new_cip3.exe
File opened (read-only)	\??\Q:	64new_cip3.exe
File opened (read-only)	\??\S:	64new_cip3.exe
File opened (read-only)	\??\B:	64new_cip3.exe
File opened (read-only)	\??\M:	64new_cip3.exe
File opened (read-only)	\??\U:	64new_cip3.exe
File opened (read-only)	\??\Y:	64new_cip3.exe
File opened (read-only)	\??\P:	64new_cip3.exe
File opened (read-only)	\??\R:	64new_cip3.exe
File opened (read-only)	\??\Z:	64new_cip3.exe
File opened (read-only)	\??\E:	64new_cip3.exe
File opened (read-only)	\??\F:	64new_cip3.exe
File opened (read-only)	\??\J:	64new_cip3.exe
File opened (read-only)	\??\K:	64new_cip3.exe
File opened (read-only)	\??\O:	64new_cip3.exe
File opened (read-only)	\??\T:	64new_cip3.exe
File opened (read-only)	\??\X:	64new_cip3.exe
File opened (read-only)	\??\A:	64new_cip3.exe
File opened (read-only)	\??\G:	64new_cip3.exe
File opened (read-only)	\??\H:	64new_cip3.exe
File opened (read-only)	\??\L:	64new_cip3.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3100	2940	WerFault.exe	40
3424	3636	WerFault.exe	207

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

pid	Process
1836	vssadmin.exe

Kills process with taskkill 16 IoCs

evasion

pid	Process
4252	taskkill.exe
4512	taskkill.exe
1512	taskkill.exe
3700	taskkill.exe
3212	taskkill.exe
2888	taskkill.exe
748	taskkill.exe
2512	taskkill.exe
2120	taskkill.exe
4572	taskkill.exe
2916	taskkill.exe
2228	taskkill.exe
2472	taskkill.exe
1984	taskkill.exe
5068	taskkill.exe
3760	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{D11ECE11-E2D1-4AAA-8356-6A601FD72316}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe
2320	64new_cip3.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	3700	taskkill.exe
Token: SeDebugPrivilege	3212	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	2472	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	1512	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	4572	taskkill.exe
Token: SeDebugPrivilege	748	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	3760	taskkill.exe
Token: SeDebugPrivilege	2228	taskkill.exe
Token: SeShutdownPrivilege	3636	explorer.exe
Token: SeCreatePagefilePrivilege	3636	explorer.exe
Token: SeShutdownPrivilege	3636	explorer.exe
Token: SeCreatePagefilePrivilege	3636	explorer.exe
Token: SeShutdownPrivilege	3636	explorer.exe
Token: SeCreatePagefilePrivilege	3636	explorer.exe
Token: SeShutdownPrivilege	3636	explorer.exe
Token: SeCreatePagefilePrivilege	3636	explorer.exe
Token: SeShutdownPrivilege	3636	explorer.exe
Token: SeCreatePagefilePrivilege	3636	explorer.exe
Token: SeBackupPrivilege	4984	vssvc.exe
Token: SeRestorePrivilege	4984	vssvc.exe
Token: SeAuditPrivilege	4984	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4180	WMIC.exe
Token: SeSecurityPrivilege	4180	WMIC.exe
Token: SeTakeOwnershipPrivilege	4180	WMIC.exe
Token: SeLoadDriverPrivilege	4180	WMIC.exe
Token: SeSystemProfilePrivilege	4180	WMIC.exe
Token: SeSystemtimePrivilege	4180	WMIC.exe
Token: SeProfSingleProcessPrivilege	4180	WMIC.exe
Token: SeIncBasePriorityPrivilege	4180	WMIC.exe
Token: SeCreatePagefilePrivilege	4180	WMIC.exe
Token: SeBackupPrivilege	4180	WMIC.exe
Token: SeRestorePrivilege	4180	WMIC.exe
Token: SeShutdownPrivilege	4180	WMIC.exe
Token: SeDebugPrivilege	4180	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4180	WMIC.exe
Token: SeRemoteShutdownPrivilege	4180	WMIC.exe
Token: SeUndockPrivilege	4180	WMIC.exe
Token: SeManageVolumePrivilege	4180	WMIC.exe
Token: 33	4180	WMIC.exe
Token: 34	4180	WMIC.exe
Token: 35	4180	WMIC.exe
Token: 36	4180	WMIC.exe
Token: SeShutdownPrivilege	3636	explorer.exe
Token: SeCreatePagefilePrivilege	3636	explorer.exe
Token: SeShutdownPrivilege	3636	explorer.exe
Token: SeCreatePagefilePrivilege	3636	explorer.exe
Token: SeBackupPrivilege	796	wbengine.exe
Token: SeRestorePrivilege	796	wbengine.exe
Token: SeSecurityPrivilege	796	wbengine.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe
3636	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2580	2320	64new_cip3.exe	84
PID 2320 wrote to memory of 2580	2320	64new_cip3.exe	84
PID 2320 wrote to memory of 2580	2320	64new_cip3.exe	84
PID 2580 wrote to memory of 2784	2580	cmd.exe	86
PID 2580 wrote to memory of 2784	2580	cmd.exe	86
PID 2320 wrote to memory of 3972	2320	64new_cip3.exe	87
PID 2320 wrote to memory of 3972	2320	64new_cip3.exe	87
PID 2320 wrote to memory of 3972	2320	64new_cip3.exe	87
PID 3972 wrote to memory of 2824	3972	cmd.exe	89
PID 3972 wrote to memory of 2824	3972	cmd.exe	89
PID 2824 wrote to memory of 4252	2824	cmd.exe	90
PID 2824 wrote to memory of 4252	2824	cmd.exe	90
PID 2320 wrote to memory of 576	2320	64new_cip3.exe	91
PID 2320 wrote to memory of 576	2320	64new_cip3.exe	91
PID 2320 wrote to memory of 576	2320	64new_cip3.exe	91
PID 576 wrote to memory of 1528	576	cmd.exe	93
PID 576 wrote to memory of 1528	576	cmd.exe	93
PID 1528 wrote to memory of 3700	1528	cmd.exe	94
PID 1528 wrote to memory of 3700	1528	cmd.exe	94
PID 2320 wrote to memory of 4520	2320	64new_cip3.exe	95
PID 2320 wrote to memory of 4520	2320	64new_cip3.exe	95
PID 2320 wrote to memory of 4520	2320	64new_cip3.exe	95
PID 4520 wrote to memory of 2044	4520	cmd.exe	97
PID 4520 wrote to memory of 2044	4520	cmd.exe	97
PID 2044 wrote to memory of 3212	2044	cmd.exe	98
PID 2044 wrote to memory of 3212	2044	cmd.exe	98
PID 2320 wrote to memory of 3864	2320	64new_cip3.exe	99
PID 2320 wrote to memory of 3864	2320	64new_cip3.exe	99
PID 2320 wrote to memory of 3864	2320	64new_cip3.exe	99
PID 3864 wrote to memory of 1728	3864	cmd.exe	101
PID 3864 wrote to memory of 1728	3864	cmd.exe	101
PID 1728 wrote to memory of 2512	1728	cmd.exe	102
PID 1728 wrote to memory of 2512	1728	cmd.exe	102
PID 2320 wrote to memory of 2884	2320	64new_cip3.exe	103
PID 2320 wrote to memory of 2884	2320	64new_cip3.exe	103
PID 2320 wrote to memory of 2884	2320	64new_cip3.exe	103
PID 2884 wrote to memory of 4652	2884	cmd.exe	105
PID 2884 wrote to memory of 4652	2884	cmd.exe	105
PID 4652 wrote to memory of 2472	4652	cmd.exe	106
PID 4652 wrote to memory of 2472	4652	cmd.exe	106
PID 2320 wrote to memory of 2336	2320	64new_cip3.exe	107
PID 2320 wrote to memory of 2336	2320	64new_cip3.exe	107
PID 2320 wrote to memory of 2336	2320	64new_cip3.exe	107
PID 2336 wrote to memory of 5088	2336	cmd.exe	109
PID 2336 wrote to memory of 5088	2336	cmd.exe	109
PID 5088 wrote to memory of 2888	5088	cmd.exe	110
PID 5088 wrote to memory of 2888	5088	cmd.exe	110
PID 2320 wrote to memory of 3460	2320	64new_cip3.exe	111
PID 2320 wrote to memory of 3460	2320	64new_cip3.exe	111
PID 2320 wrote to memory of 3460	2320	64new_cip3.exe	111
PID 3460 wrote to memory of 3424	3460	cmd.exe	113
PID 3460 wrote to memory of 3424	3460	cmd.exe	113
PID 3424 wrote to memory of 4512	3424	cmd.exe	114
PID 3424 wrote to memory of 4512	3424	cmd.exe	114
PID 2320 wrote to memory of 1636	2320	64new_cip3.exe	115
PID 2320 wrote to memory of 1636	2320	64new_cip3.exe	115
PID 2320 wrote to memory of 1636	2320	64new_cip3.exe	115
PID 1636 wrote to memory of 4268	1636	cmd.exe	117
PID 1636 wrote to memory of 4268	1636	cmd.exe	117
PID 4268 wrote to memory of 1512	4268	cmd.exe	118
PID 4268 wrote to memory of 1512	4268	cmd.exe	118
PID 2320 wrote to memory of 2564	2320	64new_cip3.exe	119
PID 2320 wrote to memory of 2564	2320	64new_cip3.exe	119
PID 2320 wrote to memory of 2564	2320	64new_cip3.exe	119

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	64new_cip3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	64new_cip3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	64new_cip3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	64new_cip3.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2940
- C:\Users\Admin\AppData\Local\Temp\64new_cip3.exe
  "C:\Users\Admin\AppData\Local\Temp\64new_cip3.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Modifies extensions of user files
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"
      4⤵
      PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlbrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlwriter.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlwriter.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlwriter.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlservr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msmdsrv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im MsDtsSrvr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlceip.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdlauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im Ssms.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
    3⤵
    PID:2564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
      4⤵
      PID:2804
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im SQLAGENT.EXE
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
    3⤵
    PID:4132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
      4⤵
      PID:1752
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdhost.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
    3⤵
    PID:3252
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
      4⤵
      PID:4300
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdlauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe
    3⤵
    PID:3220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlservr.exe
      4⤵
      PID:3504
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlservr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
    3⤵
    PID:2328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
      4⤵
      PID:1480
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im ReportingServicesService.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
    3⤵
    PID:4020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
      4⤵
      PID:2452
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msftesql.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
    3⤵
    PID:2504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
      4⤵
      PID:4284
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im pg_ctl.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im postgres.exe
    3⤵
    PID:1276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im postgres.exe
      4⤵
      PID:3704
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im postgres.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
    3⤵
    PID:3080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
      4⤵
      PID:4232
    - - C:\Windows\system32\net.exe
        
        net stop MSSQLServerADHelper100
        5⤵
        
        PID:4448
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLServerADHelper100
        6⤵
        
        PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
    3⤵
    PID:4800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
      4⤵
      PID:4532
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$ISARS
        5⤵
        
        PID:1960
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$ISARS
        6⤵
        
        PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
    3⤵
    PID:1852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
      4⤵
      PID:1768
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$MSFW
        5⤵
        
        PID:4344
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$MSFW
        6⤵
        
        PID:988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
    3⤵
    PID:4892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
      4⤵
      PID:3416
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$ISARS
        5⤵
        
        PID:4588
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$ISARS
        6⤵
        
        PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
    3⤵
    PID:3528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
      4⤵
      PID:4364
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$MSFW
        5⤵
        
        PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
    3⤵
    PID:4200
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
      4⤵
      PID:1784
    - - C:\Windows\system32\net.exe
        
        net stop SQLBrowser
        5⤵
        
        PID:1004
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop ReportServer$ISARS
    3⤵
    PID:3296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop ReportServer$ISARS
      4⤵
      PID:1152
    - - C:\Windows\system32\net.exe
        
        net stop ReportServer$ISARS
        5⤵
        
        PID:1204
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop ReportServer$ISARS
        6⤵
        
        PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
    3⤵
    PID:4052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
      4⤵
      PID:3676
    - - C:\Windows\system32\net.exe
        
        net stop SQLWriter
        5⤵
        
        PID:1752
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    PID:4412
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      PID:2884
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin.exe Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersions:0 -quiet
    3⤵
    PID:2920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersions:0 -quiet
      4⤵
      PID:3088
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -keepVersions:0 -quiet
        5⤵
        Deletes system backups
        
        PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
    3⤵
    PID:3296
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
      4⤵
      PID:1364
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic.exe SHADOWCOPY /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
    3⤵
    PID:3076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      4⤵
      PID:1984
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        5⤵
        Deletes System State backups
        
        PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    PID:2984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      PID:4132
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTATEBACKUP
        5⤵
        Deletes System State backups
        Drops file in Windows directory
        
        PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoveryenabled No
    3⤵
    PID:4736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoveryenabled No
      4⤵
      PID:1516
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} recoveryenabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:3572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:424
- - C:\Windows\SysWOW64\cipher.exe
    cipher /w:\\?\C:
    3⤵
    PID:2000
- C:\Users\Admin\AppData\Local\Temp\64new_cip3.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\64new_cip3.exe -network
  2⤵
  - System policy modification
  PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:4820
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2940 -s 3680
  2⤵
  - Program crash
  PID:3100

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop SQLAgent$MSFW
1⤵
PID:4360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 2940 -ip 2940
1⤵
PID:4640

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3636
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3636 -s 2240
  2⤵
  - Program crash
  PID:3424

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 508 -p 3636 -ip 3636
1⤵
PID:4788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4300

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:636

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Modifies boot configuration data using bcdedit
PID:3224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery