Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 23:59
Behavioral task
behavioral1
Sample
91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe
Resource
win10v2004-20231215-en
General
-
Target
91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe
-
Size
99KB
-
MD5
88e7ae140342db545f3f735dc11db65c
-
SHA1
34ab34028399744254eb231aade8d64c9e898dad
-
SHA256
ed6d456a48377792d68401b8da536f9b00c269a18142a7123b911e6c16e068a9
-
SHA512
0df5d4319244b11bb37b400ee62fcd7748fece3edf197e33f432a4c59129d2a6407d0a900c55f1bc6be6d1239fb1f583b78d68aa6b705bb9a5957bbaaa6835f7
-
SSDEEP
3072:sZz9omcf9qy10Ve79MJAqLg39Xs/6zMQKE/O:AKmi11f79MJAqsNXNzMQKQO
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule behavioral1/memory/2024-501-0x000000013F530000-0x000000013F572000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs
resource yara_rule behavioral1/memory/2024-501-0x000000013F530000-0x000000013F572000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Detects executables referencing many IR and analysis tools 1 IoCs
resource yara_rule behavioral1/memory/2024-501-0x000000013F530000-0x000000013F572000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools -
Renames multiple (272) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/2024-0-0x000000013F530000-0x000000013F572000-memory.dmp UPX behavioral1/memory/2024-501-0x000000013F530000-0x000000013F572000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2024-0-0x000000013F530000-0x000000013F572000-memory.dmp upx behavioral1/memory/2024-501-0x000000013F530000-0x000000013F572000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-1268429524-3929314613-1992311491-1000\desktop.ini 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\U: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\O: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\A: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\H: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\B: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\N: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\R: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\P: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\S: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\L: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\X: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\V: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\W: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\I: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\J: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\K: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\Z: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\M: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\Y: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\E: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\G: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe File opened (read-only) \??\Q: 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe -
Modifies boot configuration data using bcdedit 4 IoCs
pid Process 1920 bcdedit.exe 284 bcdedit.exe 1804 bcdedit.exe 1600 bcdedit.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\readme.bmp" 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2920 vssadmin.exe 2180 vssadmin.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\WallpaperStyle = "0" 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\Desktop\TileWallpaper = "0" 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2648 WMIC.exe Token: SeSecurityPrivilege 2648 WMIC.exe Token: SeTakeOwnershipPrivilege 2648 WMIC.exe Token: SeLoadDriverPrivilege 2648 WMIC.exe Token: SeSystemProfilePrivilege 2648 WMIC.exe Token: SeSystemtimePrivilege 2648 WMIC.exe Token: SeProfSingleProcessPrivilege 2648 WMIC.exe Token: SeIncBasePriorityPrivilege 2648 WMIC.exe Token: SeCreatePagefilePrivilege 2648 WMIC.exe Token: SeBackupPrivilege 2648 WMIC.exe Token: SeRestorePrivilege 2648 WMIC.exe Token: SeShutdownPrivilege 2648 WMIC.exe Token: SeDebugPrivilege 2648 WMIC.exe Token: SeSystemEnvironmentPrivilege 2648 WMIC.exe Token: SeRemoteShutdownPrivilege 2648 WMIC.exe Token: SeUndockPrivilege 2648 WMIC.exe Token: SeManageVolumePrivilege 2648 WMIC.exe Token: 33 2648 WMIC.exe Token: 34 2648 WMIC.exe Token: 35 2648 WMIC.exe Token: SeIncreaseQuotaPrivilege 2648 WMIC.exe Token: SeSecurityPrivilege 2648 WMIC.exe Token: SeTakeOwnershipPrivilege 2648 WMIC.exe Token: SeLoadDriverPrivilege 2648 WMIC.exe Token: SeSystemProfilePrivilege 2648 WMIC.exe Token: SeSystemtimePrivilege 2648 WMIC.exe Token: SeProfSingleProcessPrivilege 2648 WMIC.exe Token: SeIncBasePriorityPrivilege 2648 WMIC.exe Token: SeCreatePagefilePrivilege 2648 WMIC.exe Token: SeBackupPrivilege 2648 WMIC.exe Token: SeRestorePrivilege 2648 WMIC.exe Token: SeShutdownPrivilege 2648 WMIC.exe Token: SeDebugPrivilege 2648 WMIC.exe Token: SeSystemEnvironmentPrivilege 2648 WMIC.exe Token: SeRemoteShutdownPrivilege 2648 WMIC.exe Token: SeUndockPrivilege 2648 WMIC.exe Token: SeManageVolumePrivilege 2648 WMIC.exe Token: 33 2648 WMIC.exe Token: 34 2648 WMIC.exe Token: 35 2648 WMIC.exe Token: SeBackupPrivilege 556 vssvc.exe Token: SeRestorePrivilege 556 vssvc.exe Token: SeAuditPrivilege 556 vssvc.exe Token: SeIncreaseQuotaPrivilege 1976 WMIC.exe Token: SeSecurityPrivilege 1976 WMIC.exe Token: SeTakeOwnershipPrivilege 1976 WMIC.exe Token: SeLoadDriverPrivilege 1976 WMIC.exe Token: SeSystemProfilePrivilege 1976 WMIC.exe Token: SeSystemtimePrivilege 1976 WMIC.exe Token: SeProfSingleProcessPrivilege 1976 WMIC.exe Token: SeIncBasePriorityPrivilege 1976 WMIC.exe Token: SeCreatePagefilePrivilege 1976 WMIC.exe Token: SeBackupPrivilege 1976 WMIC.exe Token: SeRestorePrivilege 1976 WMIC.exe Token: SeShutdownPrivilege 1976 WMIC.exe Token: SeDebugPrivilege 1976 WMIC.exe Token: SeSystemEnvironmentPrivilege 1976 WMIC.exe Token: SeRemoteShutdownPrivilege 1976 WMIC.exe Token: SeUndockPrivilege 1976 WMIC.exe Token: SeManageVolumePrivilege 1976 WMIC.exe Token: 33 1976 WMIC.exe Token: 34 1976 WMIC.exe Token: 35 1976 WMIC.exe Token: SeIncreaseQuotaPrivilege 1976 WMIC.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2216 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 29 PID 2024 wrote to memory of 2216 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 29 PID 2024 wrote to memory of 2216 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 29 PID 2024 wrote to memory of 3048 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 30 PID 2024 wrote to memory of 3048 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 30 PID 2024 wrote to memory of 3048 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 30 PID 2024 wrote to memory of 2316 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 33 PID 2024 wrote to memory of 2316 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 33 PID 2024 wrote to memory of 2316 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 33 PID 2024 wrote to memory of 2148 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 35 PID 2024 wrote to memory of 2148 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 35 PID 2024 wrote to memory of 2148 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 35 PID 3048 wrote to memory of 2648 3048 cmd.exe 37 PID 3048 wrote to memory of 2648 3048 cmd.exe 37 PID 3048 wrote to memory of 2648 3048 cmd.exe 37 PID 2148 wrote to memory of 1920 2148 cmd.exe 38 PID 2148 wrote to memory of 1920 2148 cmd.exe 38 PID 2148 wrote to memory of 1920 2148 cmd.exe 38 PID 2316 wrote to memory of 284 2316 cmd.exe 39 PID 2316 wrote to memory of 284 2316 cmd.exe 39 PID 2316 wrote to memory of 284 2316 cmd.exe 39 PID 2216 wrote to memory of 2920 2216 cmd.exe 40 PID 2216 wrote to memory of 2920 2216 cmd.exe 40 PID 2216 wrote to memory of 2920 2216 cmd.exe 40 PID 2024 wrote to memory of 2096 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 45 PID 2024 wrote to memory of 2096 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 45 PID 2024 wrote to memory of 2096 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 45 PID 2024 wrote to memory of 1528 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 47 PID 2024 wrote to memory of 1528 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 47 PID 2024 wrote to memory of 1528 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 47 PID 2024 wrote to memory of 2544 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 49 PID 2024 wrote to memory of 2544 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 49 PID 2024 wrote to memory of 2544 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 49 PID 2096 wrote to memory of 2180 2096 cmd.exe 50 PID 2096 wrote to memory of 2180 2096 cmd.exe 50 PID 2096 wrote to memory of 2180 2096 cmd.exe 50 PID 2024 wrote to memory of 868 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 51 PID 2024 wrote to memory of 868 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 51 PID 2024 wrote to memory of 868 2024 91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe 51 PID 1528 wrote to memory of 1976 1528 cmd.exe 54 PID 1528 wrote to memory of 1976 1528 cmd.exe 54 PID 1528 wrote to memory of 1976 1528 cmd.exe 54 PID 2544 wrote to memory of 1804 2544 cmd.exe 55 PID 2544 wrote to memory of 1804 2544 cmd.exe 55 PID 2544 wrote to memory of 1804 2544 cmd.exe 55 PID 868 wrote to memory of 1600 868 cmd.exe 56 PID 868 wrote to memory of 1600 868 cmd.exe 56 PID 868 wrote to memory of 1600 868 cmd.exe 56 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe"C:\Users\Admin\AppData\Local\Temp\91ff613c7eddb4fb74412e4be00ab7803af2e8f16ab094cf9bcc99e0e0cb1b20.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:284
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1920
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2180
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1804
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:1600
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b05e32b7e78e82f01f6f0c7d1411ee67
SHA12e1dda46f8561858b378d19a24b839062f794274
SHA256f058bc2a88431119f286f2708751f25449dc1d58e1c87de3bb38aff764c814a8
SHA5126cb7c842a48b9f982ac87280ded95e206e2b9055f9f51ea84f6060470a61a35decbb688650c0d6b7c318df018078af0c0a1afe0ce65db1b460d75ae7800e2d3c