4af89ff4b3a8783226e1d38bf7e8eea6cd135e9708b214273e6d41d024f1970f

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
20-03-2023 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
Size

332KB
MD5

315ba41e7afd432a90b91ecca8785606
SHA1

700b771bb556457b39e3b021aea3386297c17328
SHA256

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0
SHA512

d22a4936631118a675e988caa5a4f6b8fd99a113abb02c73da9dd5a67f6a20285a68ab90acce961c312492c03a9743bfc2d36959cf10ad18f6d562c893ae8d2f
SSDEEP

6144:SSu95CM96x7SQmTY3q1af/eP0J8j9HvJpktPV1Hni+oA7SCtkW:M9IM9wmTY3Uaf/eMGFWhbtkW

Score

10^/10

evasion persistence ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

description pid process target process

PID 828 created 3140 828 db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe Explorer.EXE
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2136 bcdedit.exe
4036 bcdedit.exe
Deletes System State backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

3836 wbadmin.exe
Deletes system backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

4300 wbadmin.exe

description	pid	process	target process
PID 828 created 3140	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	Explorer.EXE

pid	process
2136	bcdedit.exe
4036	bcdedit.exe

pid	process
3836	wbadmin.exe

pid	process
4300	wbadmin.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ProtectCompress.tiff	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File renamed	C:\Users\Admin\Pictures\ProtectCompress.tiff => C:\Users\Admin\Pictures\ProtectCompress.tiff.acessd	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File renamed	C:\Users\Admin\Pictures\UseResume.crw => C:\Users\Admin\Pictures\UseResume.crw.acessd	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

description	ioc	process
File opened for modification	\??\A:\$RECYCLE.BIN\S-1-5-21-2805025096-2326403612-4231045514-1000\desktop.ini	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.execipher.exe

description	ioc	process
File opened (read-only)	\??\V:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\G:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\J:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\K:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\L:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\R:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\S:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\T:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\A:	cipher.exe
File opened (read-only)	\??\A:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\F:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\I:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\N:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\P:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\Z:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\H:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\O:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\W:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\X:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\B:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\E:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\M:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\Q:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\U:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
File opened (read-only)	\??\Y:	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

Drops file in Windows directory 3 IoCs

Processes:

wbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4620 3140 WerFault.exe Explorer.EXE
4680 4256 WerFault.exe explorer.exe
4456 1924 WerFault.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2384 vssadmin.exe

pid	pid_target	process	target process
4620	3140	WerFault.exe	Explorer.EXE
4680	4256	WerFault.exe	explorer.exe
4456	1924	WerFault.exe

pid	process
2384	vssadmin.exe

Kills process with taskkill 14 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2004	taskkill.exe
2648	taskkill.exe
2992	taskkill.exe
3696	taskkill.exe
3960	taskkill.exe
488	taskkill.exe
2364	taskkill.exe
4084	taskkill.exe
5036	taskkill.exe
1284	taskkill.exe
1332	taskkill.exe
1844	taskkill.exe
2252	taskkill.exe
3744	taskkill.exe

Modifies registry class 2 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{1DC9429A-F180-46BF-ABF3-35C8F1A32F6B}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

pid	process
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exevssvc.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2004	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe
Token: SeDebugPrivilege	3696	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	1332	taskkill.exe
Token: SeDebugPrivilege	3960	taskkill.exe
Token: SeDebugPrivilege	1844	taskkill.exe
Token: SeDebugPrivilege	488	taskkill.exe
Token: SeDebugPrivilege	2364	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	2648	taskkill.exe
Token: SeDebugPrivilege	1284	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4888	WMIC.exe
Token: SeSecurityPrivilege	4888	WMIC.exe
Token: SeTakeOwnershipPrivilege	4888	WMIC.exe
Token: SeLoadDriverPrivilege	4888	WMIC.exe
Token: SeSystemProfilePrivilege	4888	WMIC.exe
Token: SeSystemtimePrivilege	4888	WMIC.exe
Token: SeProfSingleProcessPrivilege	4888	WMIC.exe
Token: SeIncBasePriorityPrivilege	4888	WMIC.exe
Token: SeCreatePagefilePrivilege	4888	WMIC.exe
Token: SeBackupPrivilege	4888	WMIC.exe
Token: SeRestorePrivilege	4888	WMIC.exe
Token: SeShutdownPrivilege	4888	WMIC.exe
Token: SeDebugPrivilege	4888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4888	WMIC.exe
Token: SeRemoteShutdownPrivilege	4888	WMIC.exe
Token: SeUndockPrivilege	4888	WMIC.exe
Token: SeManageVolumePrivilege	4888	WMIC.exe
Token: 33	4888	WMIC.exe
Token: 34	4888	WMIC.exe
Token: 35	4888	WMIC.exe
Token: 36	4888	WMIC.exe
Token: SeBackupPrivilege	1256	vssvc.exe
Token: SeRestorePrivilege	1256	vssvc.exe
Token: SeAuditPrivilege	1256	vssvc.exe
Token: SeShutdownPrivilege	4256	explorer.exe
Token: SeCreatePagefilePrivilege	4256	explorer.exe
Token: SeShutdownPrivilege	4256	explorer.exe
Token: SeCreatePagefilePrivilege	4256	explorer.exe
Token: SeShutdownPrivilege	4256	explorer.exe
Token: SeCreatePagefilePrivilege	4256	explorer.exe
Token: SeShutdownPrivilege	4256	explorer.exe
Token: SeCreatePagefilePrivilege	4256	explorer.exe
Token: SeShutdownPrivilege	4256	explorer.exe
Token: SeCreatePagefilePrivilege	4256	explorer.exe
Token: SeShutdownPrivilege	4256	explorer.exe
Token: SeCreatePagefilePrivilege	4256	explorer.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

explorer.exe

pid process

4256 explorer.exe
4256 explorer.exe
4256 explorer.exe
4256 explorer.exe
4256 explorer.exe
4256 explorer.exe

Suspicious use of SendNotifyMessage 14 IoCs

Processes:

explorer.exe

pid	process
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe
4256	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 828 wrote to memory of 2684	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2684	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2684	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 2684 wrote to memory of 2136	2684	cmd.exe	cmd.exe
PID 2684 wrote to memory of 2136	2684	cmd.exe	cmd.exe
PID 828 wrote to memory of 4880	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 4880	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 4880	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 4880 wrote to memory of 4092	4880	cmd.exe	cmd.exe
PID 4880 wrote to memory of 4092	4880	cmd.exe	cmd.exe
PID 4092 wrote to memory of 2004	4092	cmd.exe	taskkill.exe
PID 4092 wrote to memory of 2004	4092	cmd.exe	taskkill.exe
PID 828 wrote to memory of 3432	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 3432	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 3432	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 3432 wrote to memory of 228	3432	cmd.exe	cmd.exe
PID 3432 wrote to memory of 228	3432	cmd.exe	cmd.exe
PID 228 wrote to memory of 2992	228	cmd.exe	taskkill.exe
PID 228 wrote to memory of 2992	228	cmd.exe	taskkill.exe
PID 828 wrote to memory of 2980	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2980	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2980	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 2980 wrote to memory of 5056	2980	cmd.exe	cmd.exe
PID 2980 wrote to memory of 5056	2980	cmd.exe	cmd.exe
PID 5056 wrote to memory of 4084	5056	cmd.exe	taskkill.exe
PID 5056 wrote to memory of 4084	5056	cmd.exe	taskkill.exe
PID 828 wrote to memory of 1896	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 1896	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 1896	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 1896 wrote to memory of 4776	1896	cmd.exe	cmd.exe
PID 1896 wrote to memory of 4776	1896	cmd.exe	cmd.exe
PID 4776 wrote to memory of 3696	4776	cmd.exe	taskkill.exe
PID 4776 wrote to memory of 3696	4776	cmd.exe	taskkill.exe
PID 828 wrote to memory of 4408	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 4408	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 4408	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 4408 wrote to memory of 2112	4408	cmd.exe	cmd.exe
PID 4408 wrote to memory of 2112	4408	cmd.exe	cmd.exe
PID 2112 wrote to memory of 5036	2112	cmd.exe	taskkill.exe
PID 2112 wrote to memory of 5036	2112	cmd.exe	taskkill.exe
PID 828 wrote to memory of 1764	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 1764	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 1764	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 1764 wrote to memory of 3776	1764	cmd.exe	cmd.exe
PID 1764 wrote to memory of 3776	1764	cmd.exe	cmd.exe
PID 3776 wrote to memory of 1332	3776	cmd.exe	taskkill.exe
PID 3776 wrote to memory of 1332	3776	cmd.exe	taskkill.exe
PID 828 wrote to memory of 5088	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 5088	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 5088	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 5088 wrote to memory of 3000	5088	cmd.exe	cmd.exe
PID 5088 wrote to memory of 3000	5088	cmd.exe	cmd.exe
PID 3000 wrote to memory of 3960	3000	cmd.exe	taskkill.exe
PID 3000 wrote to memory of 3960	3000	cmd.exe	taskkill.exe
PID 828 wrote to memory of 2752	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2752	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2752	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 2752 wrote to memory of 1788	2752	cmd.exe	cmd.exe
PID 2752 wrote to memory of 1788	2752	cmd.exe	cmd.exe
PID 1788 wrote to memory of 1844	1788	cmd.exe	taskkill.exe
PID 1788 wrote to memory of 1844	1788	cmd.exe	taskkill.exe
PID 828 wrote to memory of 2672	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2672	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe
PID 828 wrote to memory of 2672	828	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe	cmd.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exedb283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3140
- C:\Users\Admin\AppData\Local\Temp\db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
  "C:\Users\Admin\AppData\Local\Temp\db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Modifies extensions of user files
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:828
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"
      4⤵
      PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlbrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sql writer.exe
        5⤵
        Kills process with taskkill
        
        PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlserv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4776
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msmdsrv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im MsDtsSrvr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3776
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlceip.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdlauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im Ssms.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
    3⤵
    PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
      4⤵
      PID:1656
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im SQLAGENT.EXE
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:488
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
    3⤵
    PID:2184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
      4⤵
      PID:2328
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdhost.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
    3⤵
    PID:748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
      4⤵
      PID:3728
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im ReportingServicesService.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
    3⤵
    PID:560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
      4⤵
      PID:3756
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msftesql.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
    3⤵
    PID:4552
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
      4⤵
      PID:1264
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im pg_ctl.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
    3⤵
    PID:4620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe
      4⤵
      PID:2004
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -impostgres.exe
        5⤵
        Kills process with taskkill
        
        PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
    3⤵
    PID:32
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
      4⤵
      PID:116
    - - C:\Windows\system32\net.exe
        
        net stop MSSQLServerADHelper100
        5⤵
        
        PID:264
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLServerADHelper100
        6⤵
        
        PID:216
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
    3⤵
    PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
      4⤵
      PID:4084
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$ISARS
        5⤵
        
        PID:4464
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$ISARS
        6⤵
        
        PID:4236
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
    3⤵
    PID:4428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
      4⤵
      PID:4664
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$MSFW
        5⤵
        
        PID:2736
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$MSFW
        6⤵
        
        PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
    3⤵
    PID:4484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
      4⤵
      PID:4380
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$ISARS
        5⤵
        
        PID:3820
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$ISARS
        6⤵
        
        PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
    3⤵
    PID:4404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
      4⤵
      PID:1644
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$MSFW
        5⤵
        
        PID:1456
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$MSFW
        6⤵
        
        PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
    3⤵
    PID:4244
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
      4⤵
      PID:2092
    - - C:\Windows\system32\net.exe
        
        net stop SQLBrowser
        5⤵
        
        PID:5104
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:3684
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
    3⤵
    PID:4456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS
      4⤵
      PID:4112
    - - C:\Windows\system32\net.exe
        
        net stop REportServer$ISARS
        5⤵
        
        PID:2552
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop REportServer$ISARS
        6⤵
        
        PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
    3⤵
    PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
      4⤵
      PID:1768
    - - C:\Windows\system32\net.exe
        
        net stop SQLWriter
        5⤵
        
        PID:4724
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:3448
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    PID:3156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      PID:5020
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin.exe Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
    3⤵
    PID:2688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
      4⤵
      PID:4720
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -keepVersion:0 -quiet
        5⤵
        Deletes system backups
        
        PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    PID:928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      PID:3324
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTATEBACKUP
        5⤵
        Deletes System State backups
        
        PID:3836
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
    3⤵
    PID:4320
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
      4⤵
      PID:2648
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic.exe SHADOWCOPY /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:2020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:4956
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
    3⤵
    PID:3636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
      4⤵
      PID:4636
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} recoverynabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4036
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
    3⤵
    PID:4528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
      4⤵
      PID:1980
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
        5⤵
        Drops file in Windows directory
        
        PID:4988
- - C:\Windows\SysWOW64\cipher.exe
    cipher /w:\\?\A:
    3⤵
    - Enumerates connected drives
    PID:2328
- - C:\Windows\SysWOW64\cipher.exe
    cipher /w:\\?\C:
    3⤵
    PID:1876
- C:\Users\Admin\AppData\Local\Temp\db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\db283565dde766bc4e436d0a61855497a6491b0ef09d024ba3b52ca8676ee2a0.exe -network
  2⤵
  - System policy modification
  PID:100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c pause
    3⤵
    PID:3508
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3140 -s 7116
  2⤵
  - Program crash
  PID:4620

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 3140 -ip 3140
1⤵
PID:2660

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4256 -s 2188
  2⤵
  - Program crash
  PID:4680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 4256 -ip 4256
1⤵
PID:228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 1924 -ip 1924
1⤵
PID:2088

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1924 -s 1472
1⤵
- Program crash
PID:4456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

Filesize
1.3MB

MD5
483b5bb0d5e93bf26bc11144c71dcfd4

SHA1
81f996380f545a30a4de6c7fb163dcbcf6e80771

SHA256
d5ce7c71f7e009175d1b32c14f820429885789ce4c3fadc9463a7d61f92422d1

SHA512
ca3eca5de4f8772e61fb2a4b49f0a279d53c89d965e039cf0156c7a6d702f8217b6d914800040bc873ee820f9f2f1d3fc939b0c58f3b3b0101c5f5f28b7379b4

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.acessd

Filesize
624KB

MD5
53669f0c096349f72912dddccf647fea

SHA1
e1c9a246b841ea87d0e8d16ff9db963e89205346

SHA256
74dcebd0209503e80bd0e99e84f4019f7510b1f988cb1ee63555df0585755c5e

SHA512
56109da3a4f25a6693c97ed04bf20616d34edc2afabb23aebbff46a5e316f75ef346c8f00128043f74522583cadd6ca584d9904f904aef64e85e0be15798f72f

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

Filesize
141KB

MD5
bd439912567c0d30f87c665db02df6ab

SHA1
53c276c49c84c6c481b68c1c9b1069a560d0665f

SHA256
b7943ef8bb2b5884dd9d55e371a49ca51cbb934e8e9b37ac26e11d5a2bf5d95c

SHA512
69b7eb30984ac79771eda3ddb66b110e973cbfd57ba27e6ccd561fcb6aaab9903b28ce9c4aa3c1e34214e5fa69f0066e191fd5f4cd646e42984cfca61368744b

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
1KB

MD5
03802e4accfb754f40736d34bf4472f4

SHA1
b2a52877f8b7ee3732afc2ce3488d96bfe44a2d1

SHA256
6efc792ef246dad0ec46ce778d3d920dfd5ebf35a2457e8d22fade1867b51845

SHA512
e9c62a276e2090d7bac2e66a2a4aa3e31354a48888b44dca8f2fdfdc51bb873cde9f04b71af62018f4bb938609bbe65b654533aa77bc2e2739dd6e63a7e7f188

Download Submit
C:\Users\How_to_back_files.html

Filesize
4KB

MD5
cf17d543b0439995a808d1555d47680e

SHA1
98224399248fc9f7929fb97051cebc8f9beef091

SHA256
dc07e01cb7c57e69a885d9ea213ae36b93dfc9d7ca60d75dd7bd0f2ab805ca40

SHA512
9eff4ff8fe969baa8ffbc9df24709ec318998df1dd8d93aff71ec6267cd4263b9067551ed938a7594a1808997df5ca9efa8903685d4b23cb0bdb49f6999f085a

Download Submit