eternity | f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

Analysis

max time kernel
300s
max time network
183s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
19/01/2023, 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
Size

112KB
MD5

adc58a2e5e4ee12e37210bb1ce44e92a
SHA1

1f88297c23d085b4c9fa8491c3769b66ac75b28e
SHA256

f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f
SHA512

9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be
SSDEEP

3072:awEBEGyAUxgnLEKKph6bSBrIbznbKLkcYloZji:acAUxgnLIh6mJIbbGYloZ

Score

10^/10

eternity evasion ransomware

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ExportEnable.tiff	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File renamed	C:\Users\Admin\Pictures\ExportEnable.tiff => C:\Users\Admin\Pictures\ExportEnable.tiff.ecrp	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File renamed	C:\Users\Admin\Pictures\GrantRestart.raw => C:\Users\Admin\Pictures\GrantRestart.raw.ecrp	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File renamed	C:\Users\Admin\Pictures\RequestRegister.raw => C:\Users\Admin\Pictures\RequestRegister.raw.ecrp	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File renamed	C:\Users\Admin\Pictures\SelectWatch.tif => C:\Users\Admin\Pictures\SelectWatch.tif.ecrp	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File renamed	C:\Users\Admin\Pictures\SetOut.crw => C:\Users\Admin\Pictures\SetOut.crw.ecrp	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File renamed	C:\Users\Admin\Pictures\SkipGrant.tif => C:\Users\Admin\Pictures\SkipGrant.tif.ecrp	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Drops desktop.ini file(s) 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Downloads\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Pictures\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Desktop\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Downloads\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
File created	C:\Users\Admin\Pictures\desktop.ini	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4340	schtasks.exe

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1260	vssadmin.exe
3492	vssadmin.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\.ecrp	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\.ecrp\shell\open\command	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\.ecrp\shell	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\.ecrp\shell\open	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe %1"	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\.ecrp\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\ServiceHub\\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe %1"	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4628	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
Token: SeBackupPrivilege	2836	vssvc.exe
Token: SeRestorePrivilege	2836	vssvc.exe
Token: SeAuditPrivilege	2836	vssvc.exe
Token: SeDebugPrivilege	2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3420	4988	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	67
PID 4988 wrote to memory of 3420	4988	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	67
PID 4988 wrote to memory of 3420	4988	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	67
PID 3420 wrote to memory of 2628	3420	cmd.exe	69
PID 3420 wrote to memory of 2628	3420	cmd.exe	69
PID 3420 wrote to memory of 2628	3420	cmd.exe	69
PID 3420 wrote to memory of 4628	3420	cmd.exe	70
PID 3420 wrote to memory of 4628	3420	cmd.exe	70
PID 3420 wrote to memory of 4628	3420	cmd.exe	70
PID 3420 wrote to memory of 4340	3420	cmd.exe	71
PID 3420 wrote to memory of 4340	3420	cmd.exe	71
PID 3420 wrote to memory of 4340	3420	cmd.exe	71
PID 3420 wrote to memory of 4220	3420	cmd.exe	72
PID 3420 wrote to memory of 4220	3420	cmd.exe	72
PID 3420 wrote to memory of 4220	3420	cmd.exe	72
PID 4220 wrote to memory of 4804	4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	77
PID 4220 wrote to memory of 4804	4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	77
PID 4220 wrote to memory of 4804	4220	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	77
PID 4804 wrote to memory of 512	4804	cmd.exe	79
PID 4804 wrote to memory of 512	4804	cmd.exe	79
PID 4804 wrote to memory of 512	4804	cmd.exe	79
PID 4804 wrote to memory of 1260	4804	cmd.exe	80
PID 4804 wrote to memory of 1260	4804	cmd.exe	80
PID 4804 wrote to memory of 1260	4804	cmd.exe	80
PID 2000 wrote to memory of 4112	2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	85
PID 2000 wrote to memory of 4112	2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	85
PID 2000 wrote to memory of 4112	2000	f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe	85
PID 4112 wrote to memory of 3456	4112	cmd.exe	87
PID 4112 wrote to memory of 3456	4112	cmd.exe	87
PID 4112 wrote to memory of 3456	4112	cmd.exe	87
PID 4112 wrote to memory of 3492	4112	cmd.exe	88
PID 4112 wrote to memory of 3492	4112	cmd.exe	88
PID 4112 wrote to memory of 3492	4112	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
"C:\Users\Admin\AppData\Local\Temp\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4340
- - C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
    "C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe"
    3⤵
    - Executes dropped EXE
    - Modifies extensions of user files
    - Drops desktop.ini file(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:512
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:1260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && vssadmin delete shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File Deletion

T1107

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe.log

Filesize
609B

MD5
ba85b517e3c32cd1f3ae72c6f70ed3a1

SHA1
0935cac5a17aa27944f6999044002238613fb179

SHA256
2d26a2a23b8193c97adbea07d368d60c2c2668faf1628c09af8d1f2b93ec9d91

SHA512
aa3c6b20f68406eb70a3aae678155429f3d1497323c195753cea616f96e43171663d29372a9999a79b65660213494f95d39aa083afcef304518f06e727ccdcc8

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Filesize
112KB

MD5
adc58a2e5e4ee12e37210bb1ce44e92a

SHA1
1f88297c23d085b4c9fa8491c3769b66ac75b28e

SHA256
f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

SHA512
9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Filesize
112KB

MD5
adc58a2e5e4ee12e37210bb1ce44e92a

SHA1
1f88297c23d085b4c9fa8491c3769b66ac75b28e

SHA256
f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

SHA512
9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f.exe

Filesize
112KB

MD5
adc58a2e5e4ee12e37210bb1ce44e92a

SHA1
1f88297c23d085b4c9fa8491c3769b66ac75b28e

SHA256
f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

SHA512
9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

Download Submit
memory/2628-183-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/2628-184-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3420-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3420-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3420-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3420-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/3420-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4220-282-0x00000000055F0000-0x0000000005656000-memory.dmp

Filesize
408KB

Download
memory/4220-352-0x0000000006B80000-0x0000000006B8A000-memory.dmp

Filesize
40KB

Download
memory/4988-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-149-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

Filesize
136KB

Download
memory/4988-150-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-152-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-153-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-157-0x0000000005BE0000-0x00000000060DE000-memory.dmp

Filesize
5.0MB

Download
memory/4988-158-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/4988-159-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-160-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-171-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download
memory/4988-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp

Filesize
1.6MB

Download