Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
-
Size
798KB
-
MD5
202dd42eee0197f8951ca6b115432b30
-
SHA1
5d1a4fb62b88e28a46f1988cf0f7b035b28d424d
-
SHA256
10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952
-
SHA512
3a844c0493df3521fce56d454aab73221bda5a3a65f98b14d36975537b9df2fe5209e1c884736b5b3da5ae2b4a76225b4ffa751674d3802dfcef75cc5573d15b
-
SSDEEP
12288:uafx644Z97eXJM/0bsXGwCqjwEDBlf9plvnSAq:zA44bSPs2wwEDBnplaAq
Score
10/10
Malware Config
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload 5 IoCs
resource yara_rule behavioral2/memory/840-2-0x00000000020A0000-0x00000000021AE000-memory.dmp family_avaddon behavioral2/memory/840-3-0x0000000000400000-0x0000000001B30000-memory.dmp family_avaddon behavioral2/memory/840-270-0x0000000000400000-0x0000000001B30000-memory.dmp family_avaddon behavioral2/memory/840-276-0x00000000020A0000-0x00000000021AE000-memory.dmp family_avaddon behavioral2/memory/840-352-0x0000000000400000-0x0000000001B30000-memory.dmp family_avaddon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Renames multiple (167) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-3045580317-3728985860-206385570-1000\desktop.ini 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\N: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\S: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\X: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\H: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\O: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\R: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\W: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\Z: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\B: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\E: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\G: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\J: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\K: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\U: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\V: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\A: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\L: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\M: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\P: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\Q: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\T: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe File opened (read-only) \??\Y: 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 api.myip.com 39 api.myip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 14 IoCs
pid pid_target Process procid_target 4352 840 WerFault.exe 87 1792 840 WerFault.exe 87 1048 840 WerFault.exe 87 3076 840 WerFault.exe 87 536 840 WerFault.exe 87 2076 840 WerFault.exe 87 3756 840 WerFault.exe 87 4060 840 WerFault.exe 87 3776 840 WerFault.exe 87 2532 840 WerFault.exe 87 4624 840 WerFault.exe 87 384 840 WerFault.exe 87 3756 840 WerFault.exe 87 3136 840 WerFault.exe 87 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2684 wmic.exe Token: SeSecurityPrivilege 2684 wmic.exe Token: SeTakeOwnershipPrivilege 2684 wmic.exe Token: SeLoadDriverPrivilege 2684 wmic.exe Token: SeSystemProfilePrivilege 2684 wmic.exe Token: SeSystemtimePrivilege 2684 wmic.exe Token: SeProfSingleProcessPrivilege 2684 wmic.exe Token: SeIncBasePriorityPrivilege 2684 wmic.exe Token: SeCreatePagefilePrivilege 2684 wmic.exe Token: SeBackupPrivilege 2684 wmic.exe Token: SeRestorePrivilege 2684 wmic.exe Token: SeShutdownPrivilege 2684 wmic.exe Token: SeDebugPrivilege 2684 wmic.exe Token: SeSystemEnvironmentPrivilege 2684 wmic.exe Token: SeRemoteShutdownPrivilege 2684 wmic.exe Token: SeUndockPrivilege 2684 wmic.exe Token: SeManageVolumePrivilege 2684 wmic.exe Token: 33 2684 wmic.exe Token: 34 2684 wmic.exe Token: 35 2684 wmic.exe Token: 36 2684 wmic.exe Token: SeIncreaseQuotaPrivilege 3380 wmic.exe Token: SeSecurityPrivilege 3380 wmic.exe Token: SeTakeOwnershipPrivilege 3380 wmic.exe Token: SeLoadDriverPrivilege 3380 wmic.exe Token: SeSystemProfilePrivilege 3380 wmic.exe Token: SeSystemtimePrivilege 3380 wmic.exe Token: SeProfSingleProcessPrivilege 3380 wmic.exe Token: SeIncBasePriorityPrivilege 3380 wmic.exe Token: SeCreatePagefilePrivilege 3380 wmic.exe Token: SeBackupPrivilege 3380 wmic.exe Token: SeRestorePrivilege 3380 wmic.exe Token: SeShutdownPrivilege 3380 wmic.exe Token: SeDebugPrivilege 3380 wmic.exe Token: SeSystemEnvironmentPrivilege 3380 wmic.exe Token: SeRemoteShutdownPrivilege 3380 wmic.exe Token: SeUndockPrivilege 3380 wmic.exe Token: SeManageVolumePrivilege 3380 wmic.exe Token: 33 3380 wmic.exe Token: 34 3380 wmic.exe Token: 35 3380 wmic.exe Token: 36 3380 wmic.exe Token: SeIncreaseQuotaPrivilege 1784 wmic.exe Token: SeSecurityPrivilege 1784 wmic.exe Token: SeTakeOwnershipPrivilege 1784 wmic.exe Token: SeLoadDriverPrivilege 1784 wmic.exe Token: SeSystemProfilePrivilege 1784 wmic.exe Token: SeSystemtimePrivilege 1784 wmic.exe Token: SeProfSingleProcessPrivilege 1784 wmic.exe Token: SeIncBasePriorityPrivilege 1784 wmic.exe Token: SeCreatePagefilePrivilege 1784 wmic.exe Token: SeBackupPrivilege 1784 wmic.exe Token: SeRestorePrivilege 1784 wmic.exe Token: SeShutdownPrivilege 1784 wmic.exe Token: SeDebugPrivilege 1784 wmic.exe Token: SeSystemEnvironmentPrivilege 1784 wmic.exe Token: SeRemoteShutdownPrivilege 1784 wmic.exe Token: SeUndockPrivilege 1784 wmic.exe Token: SeManageVolumePrivilege 1784 wmic.exe Token: 33 1784 wmic.exe Token: 34 1784 wmic.exe Token: 35 1784 wmic.exe Token: 36 1784 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 840 wrote to memory of 2684 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 119 PID 840 wrote to memory of 2684 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 119 PID 840 wrote to memory of 2684 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 119 PID 840 wrote to memory of 3380 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 122 PID 840 wrote to memory of 3380 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 122 PID 840 wrote to memory of 3380 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 122 PID 840 wrote to memory of 1784 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 124 PID 840 wrote to memory of 1784 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 124 PID 840 wrote to memory of 1784 840 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe 124 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe"C:\Users\Admin\AppData\Local\Temp\10d2acf2624e52b9dd5f5a78b14bcdf7728bb9ef76f90008f622a5381d555952.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:840 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 8762⤵
- Program crash
PID:4352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 9202⤵
- Program crash
PID:1792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 9202⤵
- Program crash
PID:1048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 9362⤵
- Program crash
PID:3076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 10322⤵
- Program crash
PID:536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 11562⤵
- Program crash
PID:2076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 15482⤵
- Program crash
PID:3756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 16122⤵
- Program crash
PID:4060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 18122⤵
- Program crash
PID:3776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 16242⤵
- Program crash
PID:2532
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 16162⤵
- Program crash
PID:4624
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 17882⤵
- Program crash
PID:384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 23202⤵
- Program crash
PID:3756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 9282⤵
- Program crash
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 840 -ip 8401⤵PID:440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 840 -ip 8401⤵PID:4708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 840 -ip 8401⤵PID:3528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 840 -ip 8401⤵PID:4876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 840 -ip 8401⤵PID:3024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 840 -ip 8401⤵PID:640
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 840 -ip 8401⤵PID:5112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 840 -ip 8401⤵PID:4276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 840 -ip 8401⤵PID:2344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 840 -ip 8401⤵PID:1076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 840 -ip 8401⤵PID:4536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 840 -ip 8401⤵PID:3680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 840 -ip 8401⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 840 -ip 8401⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2