Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
405s -
max time network
408s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26/05/2023, 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe
Resource
win7-20230220-en
windows7-x64
12 signatures
600 seconds
Behavioral task
behavioral2
Sample
f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
14 signatures
600 seconds
General
-
Target
f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe
-
Size
129KB
-
MD5
3e6613fb7521062d41826e4460f7d630
-
SHA1
7136124383c127028e91946a7b1cb942088cf3d9
-
SHA256
f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32
-
SHA512
9cc6f870c2f64460231481f93d86fe0b2a4f2bcf98d4893faa0dacf239db56be4be460ae17aa8e8067d3c4e1220d405db2f5eba4a42583851069ea518d8526ac
-
SSDEEP
3072:VLbLpVIYbQf91G3im/2Ef07Jysg1n8Ovz4pt6YwSabakoEMQB/jS3fevYugrO6OL:VTpVPnx6aako0BSvmYBrrOu3SbuO06
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (9315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SyncPush.tiff f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\wxpr.dll.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8F.GIF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-middle.png f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01221K.JPG f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OIS_F_COL.HXK f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libd3d11va_plugin.dll.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15277_.GIF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\#FILEENCRYPTED.txt f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CharSetTable.chr.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\7-Zip\descript.ion.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\#FILEENCRYPTED.txt f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15135_.GIF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunec.jar f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageStyle.css f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00394_.WMF.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\settings.js f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Generic.css.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_ja.jar f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01701_.WMF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299171.WMF.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199036.WMF.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\jaccess.jar f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\#FILEENCRYPTED.txt f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19828_.WMF.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4B.GIF.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\PMAILEXT.ECF f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.EMAIL=[[email protected]]ID=[A883F7AA2ED1B445].FAST f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\#FILEENCRYPTED.txt f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1544 vssadmin.exe 1188 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 1480 vssvc.exe Token: SeRestorePrivilege 1480 vssvc.exe Token: SeAuditPrivilege 1480 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1200 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 29 PID 2036 wrote to memory of 1200 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 29 PID 2036 wrote to memory of 1200 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 29 PID 2036 wrote to memory of 1200 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 29 PID 1200 wrote to memory of 1188 1200 cmd.exe 31 PID 1200 wrote to memory of 1188 1200 cmd.exe 31 PID 1200 wrote to memory of 1188 1200 cmd.exe 31 PID 2036 wrote to memory of 1920 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 35 PID 2036 wrote to memory of 1920 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 35 PID 2036 wrote to memory of 1920 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 35 PID 2036 wrote to memory of 1920 2036 f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe 35 PID 1920 wrote to memory of 1544 1920 cmd.exe 37 PID 1920 wrote to memory of 1544 1920 cmd.exe 37 PID 1920 wrote to memory of 1544 1920 cmd.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe"C:\Users\Admin\AppData\Local\Temp\f0424f67134d4761a836bd18507de8a758b5b7204282cf14ad0be04e91f28f32.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1188
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1544
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
326B
MD534c68ebc25fb9fef0497ccd53dca874e
SHA131b57da007932acc122c1e99097d7f537b9f1ccc
SHA2560e66671e700d0423b7d5d1694be47f047f1c9062be7ea52e324955d01425a7db
SHA512c562e18d1fd178800816ed26d4341e770285db67bb435c3ad25ddc0ebf2162323338a15260ee84ffbea24002b7b9bbb76df1b0094ec29eab8522466dd7930c9b