Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 05:40
Behavioral task
behavioral1
Sample
84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe
Resource
win10v2004-20231215-en
General
-
Target
84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe
-
Size
99KB
-
MD5
bea647bc314248d390f14df1aad251b0
-
SHA1
27697991ccd3a76a38ab7ae2420162627ea2a69b
-
SHA256
ac1aa0426969aa4f3c3303ccbdfba83047cf68e01401e04e8028006a2ddb6aab
-
SHA512
c491419e885bcac5b75456bab87ed4fbb2ad02802b0d314dda7a725c236638ad2b223a80b6856ec1e8e09360bf25b99141891c56211abbb7c1667dacb4361a27
-
SSDEEP
1536:BIj43TYRX0Y9iFAK0E+4LAyKfPKHDysmOIzSw63BtuwVZY9n:QKTYRX0M/BCAyKXmczSw63zq
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 3 IoCs
resource yara_rule behavioral1/memory/2008-201-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2008-549-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2008-553-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing many references to VEEAM. Observed in ransomware 3 IoCs
resource yara_rule behavioral1/memory/2008-201-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM behavioral1/memory/2008-549-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM behavioral1/memory/2008-553-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Detects executables referencing many IR and analysis tools 3 IoCs
resource yara_rule behavioral1/memory/2008-201-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral1/memory/2008-549-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral1/memory/2008-553-0x000000013F130000-0x000000013F172000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools -
Renames multiple (322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 4 IoCs
resource yara_rule behavioral1/memory/2008-0-0x000000013F130000-0x000000013F172000-memory.dmp UPX behavioral1/memory/2008-201-0x000000013F130000-0x000000013F172000-memory.dmp UPX behavioral1/memory/2008-549-0x000000013F130000-0x000000013F172000-memory.dmp UPX behavioral1/memory/2008-553-0x000000013F130000-0x000000013F172000-memory.dmp UPX -
resource yara_rule behavioral1/memory/2008-0-0x000000013F130000-0x000000013F172000-memory.dmp upx behavioral1/memory/2008-201-0x000000013F130000-0x000000013F172000-memory.dmp upx behavioral1/memory/2008-549-0x000000013F130000-0x000000013F172000-memory.dmp upx behavioral1/memory/2008-553-0x000000013F130000-0x000000013F172000-memory.dmp upx -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\M:\$RECYCLE.BIN\S-1-5-21-1603059206-2004189698-4139800220-1000\desktop.ini 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\I: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\H: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\J: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\K: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\X: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\B: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\M: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\O: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\T: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\Y: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\S: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\G: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\Z: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\W: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\E: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\R: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\U: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\P: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\A: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\L: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\V: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\N: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe File opened (read-only) \??\F: 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe -
Modifies boot configuration data using bcdedit 4 IoCs
pid Process 2872 bcdedit.exe 2884 bcdedit.exe 1516 bcdedit.exe 2792 bcdedit.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\readme.bmp" 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 572 vssadmin.exe 2816 vssadmin.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\WallpaperStyle = "0" 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Control Panel\Desktop\TileWallpaper = "0" 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 548 WMIC.exe Token: SeSecurityPrivilege 548 WMIC.exe Token: SeTakeOwnershipPrivilege 548 WMIC.exe Token: SeLoadDriverPrivilege 548 WMIC.exe Token: SeSystemProfilePrivilege 548 WMIC.exe Token: SeSystemtimePrivilege 548 WMIC.exe Token: SeProfSingleProcessPrivilege 548 WMIC.exe Token: SeIncBasePriorityPrivilege 548 WMIC.exe Token: SeCreatePagefilePrivilege 548 WMIC.exe Token: SeBackupPrivilege 548 WMIC.exe Token: SeRestorePrivilege 548 WMIC.exe Token: SeShutdownPrivilege 548 WMIC.exe Token: SeDebugPrivilege 548 WMIC.exe Token: SeSystemEnvironmentPrivilege 548 WMIC.exe Token: SeRemoteShutdownPrivilege 548 WMIC.exe Token: SeUndockPrivilege 548 WMIC.exe Token: SeManageVolumePrivilege 548 WMIC.exe Token: 33 548 WMIC.exe Token: 34 548 WMIC.exe Token: 35 548 WMIC.exe Token: SeIncreaseQuotaPrivilege 548 WMIC.exe Token: SeSecurityPrivilege 548 WMIC.exe Token: SeTakeOwnershipPrivilege 548 WMIC.exe Token: SeLoadDriverPrivilege 548 WMIC.exe Token: SeSystemProfilePrivilege 548 WMIC.exe Token: SeSystemtimePrivilege 548 WMIC.exe Token: SeProfSingleProcessPrivilege 548 WMIC.exe Token: SeIncBasePriorityPrivilege 548 WMIC.exe Token: SeCreatePagefilePrivilege 548 WMIC.exe Token: SeBackupPrivilege 548 WMIC.exe Token: SeRestorePrivilege 548 WMIC.exe Token: SeShutdownPrivilege 548 WMIC.exe Token: SeDebugPrivilege 548 WMIC.exe Token: SeSystemEnvironmentPrivilege 548 WMIC.exe Token: SeRemoteShutdownPrivilege 548 WMIC.exe Token: SeUndockPrivilege 548 WMIC.exe Token: SeManageVolumePrivilege 548 WMIC.exe Token: 33 548 WMIC.exe Token: 34 548 WMIC.exe Token: 35 548 WMIC.exe Token: SeBackupPrivilege 1988 vssvc.exe Token: SeRestorePrivilege 1988 vssvc.exe Token: SeAuditPrivilege 1988 vssvc.exe Token: SeIncreaseQuotaPrivilege 1828 WMIC.exe Token: SeSecurityPrivilege 1828 WMIC.exe Token: SeTakeOwnershipPrivilege 1828 WMIC.exe Token: SeLoadDriverPrivilege 1828 WMIC.exe Token: SeSystemProfilePrivilege 1828 WMIC.exe Token: SeSystemtimePrivilege 1828 WMIC.exe Token: SeProfSingleProcessPrivilege 1828 WMIC.exe Token: SeIncBasePriorityPrivilege 1828 WMIC.exe Token: SeCreatePagefilePrivilege 1828 WMIC.exe Token: SeBackupPrivilege 1828 WMIC.exe Token: SeRestorePrivilege 1828 WMIC.exe Token: SeShutdownPrivilege 1828 WMIC.exe Token: SeDebugPrivilege 1828 WMIC.exe Token: SeSystemEnvironmentPrivilege 1828 WMIC.exe Token: SeRemoteShutdownPrivilege 1828 WMIC.exe Token: SeUndockPrivilege 1828 WMIC.exe Token: SeManageVolumePrivilege 1828 WMIC.exe Token: 33 1828 WMIC.exe Token: 34 1828 WMIC.exe Token: 35 1828 WMIC.exe Token: SeIncreaseQuotaPrivilege 1828 WMIC.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2812 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 29 PID 2008 wrote to memory of 2812 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 29 PID 2008 wrote to memory of 2812 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 29 PID 2008 wrote to memory of 2264 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 30 PID 2008 wrote to memory of 2264 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 30 PID 2008 wrote to memory of 2264 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 30 PID 2008 wrote to memory of 2696 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 33 PID 2008 wrote to memory of 2696 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 33 PID 2008 wrote to memory of 2696 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 33 PID 2008 wrote to memory of 2784 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 31 PID 2008 wrote to memory of 2784 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 31 PID 2008 wrote to memory of 2784 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 31 PID 2264 wrote to memory of 548 2264 cmd.exe 37 PID 2264 wrote to memory of 548 2264 cmd.exe 37 PID 2264 wrote to memory of 548 2264 cmd.exe 37 PID 2784 wrote to memory of 2872 2784 cmd.exe 38 PID 2784 wrote to memory of 2872 2784 cmd.exe 38 PID 2784 wrote to memory of 2872 2784 cmd.exe 38 PID 2812 wrote to memory of 2816 2812 cmd.exe 40 PID 2812 wrote to memory of 2816 2812 cmd.exe 40 PID 2812 wrote to memory of 2816 2812 cmd.exe 40 PID 2696 wrote to memory of 2884 2696 cmd.exe 39 PID 2696 wrote to memory of 2884 2696 cmd.exe 39 PID 2696 wrote to memory of 2884 2696 cmd.exe 39 PID 2008 wrote to memory of 2344 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 45 PID 2008 wrote to memory of 2344 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 45 PID 2008 wrote to memory of 2344 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 45 PID 2008 wrote to memory of 1032 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 47 PID 2008 wrote to memory of 1032 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 47 PID 2008 wrote to memory of 1032 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 47 PID 2008 wrote to memory of 2992 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 51 PID 2008 wrote to memory of 2992 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 51 PID 2008 wrote to memory of 2992 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 51 PID 2008 wrote to memory of 324 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 48 PID 2008 wrote to memory of 324 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 48 PID 2008 wrote to memory of 324 2008 84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe 48 PID 1032 wrote to memory of 1828 1032 cmd.exe 54 PID 1032 wrote to memory of 1828 1032 cmd.exe 54 PID 1032 wrote to memory of 1828 1032 cmd.exe 54 PID 2992 wrote to memory of 1516 2992 cmd.exe 55 PID 2992 wrote to memory of 1516 2992 cmd.exe 55 PID 2992 wrote to memory of 1516 2992 cmd.exe 55 PID 2344 wrote to memory of 572 2344 cmd.exe 56 PID 2344 wrote to memory of 572 2344 cmd.exe 56 PID 2344 wrote to memory of 572 2344 cmd.exe 56 PID 324 wrote to memory of 2792 324 cmd.exe 58 PID 324 wrote to memory of 2792 324 cmd.exe 58 PID 324 wrote to memory of 2792 324 cmd.exe 58 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe"C:\Users\Admin\AppData\Local\Temp\84a12b237c8acc8fc9008da6c48f9a2dffd9feaa2f283968d420250235e2fb34.exe"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2816
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2872
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:2884
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:572
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic SHADOWCOPY DELETE2⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\System32\Wbem\WMIC.exewmic SHADOWCOPY DELETE3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2792
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit / set{ default } recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\bcdedit.exebcdedit / set{ default } recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:1516
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b05e32b7e78e82f01f6f0c7d1411ee67
SHA12e1dda46f8561858b378d19a24b839062f794274
SHA256f058bc2a88431119f286f2708751f25449dc1d58e1c87de3bb38aff764c814a8
SHA5126cb7c842a48b9f982ac87280ded95e206e2b9055f9f51ea84f6060470a61a35decbb688650c0d6b7c318df018078af0c0a1afe0ce65db1b460d75ae7800e2d3c