Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 11:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe
-
Size
1.0MB
-
MD5
d3d9ad65fb3fb6f1eae29527b61ae7c0
-
SHA1
cdaaa01b42d3b4a325c11fdd7779ade9044e9946
-
SHA256
63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6
-
SHA512
171b12d4e345e67a4bfa43e2be66b5e18ccd61d2dee0f7b520c995595d62c258f1a4a865c8b8cdf6a9aa0c7b467eb10989b3ddc5291f4196e95276b94ba1cb7c
-
SSDEEP
24576:nZeCB1cqVAtVi+0ZMdbIudTkvk7WCuwJLMBhRCLlX:n8UTMdkGBuHKX
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI ransomware.
If you try to use any additional recovery software - the files might be damaged or lost.
To make sure that we REALLY CAN recover data - we offer you to decrypt samples.
You can contact us for further instructions through:
Our website
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.click
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP
---BEGIN ID---
8MGCXlEjLLwou0tFoQYUZj9ZTcMQsceR7KKS8uxqdm5vRusaXoRbuMayM1sxKpc8
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.click
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Renames multiple (7272) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\de-de\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\plugins\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_18.svg 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\uk-ua\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateDCFiles_280x192.svg 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_CA\added.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ja-jp\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Comments.aapp 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_18.svg 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\hu-hu\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\move.svg 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files\Internet Explorer\it-IT\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files\VideoLAN\VLC\locale\et\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\icudt26l.dat 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugin.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nl-nl\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\DEEPBLUE.INF 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files\VideoLAN\VLC\locale\he\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\it-it\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\sk-sk\readme.txt 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\joni.md 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ko_get.svg 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pl-pl\ui-strings.js 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4460 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe 4460 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 1928 vssvc.exe Token: SeRestorePrivilege 1928 vssvc.exe Token: SeAuditPrivilege 1928 vssvc.exe Token: SeIncreaseQuotaPrivilege 400 WMIC.exe Token: SeSecurityPrivilege 400 WMIC.exe Token: SeTakeOwnershipPrivilege 400 WMIC.exe Token: SeLoadDriverPrivilege 400 WMIC.exe Token: SeSystemProfilePrivilege 400 WMIC.exe Token: SeSystemtimePrivilege 400 WMIC.exe Token: SeProfSingleProcessPrivilege 400 WMIC.exe Token: SeIncBasePriorityPrivilege 400 WMIC.exe Token: SeCreatePagefilePrivilege 400 WMIC.exe Token: SeBackupPrivilege 400 WMIC.exe Token: SeRestorePrivilege 400 WMIC.exe Token: SeShutdownPrivilege 400 WMIC.exe Token: SeDebugPrivilege 400 WMIC.exe Token: SeSystemEnvironmentPrivilege 400 WMIC.exe Token: SeRemoteShutdownPrivilege 400 WMIC.exe Token: SeUndockPrivilege 400 WMIC.exe Token: SeManageVolumePrivilege 400 WMIC.exe Token: 33 400 WMIC.exe Token: 34 400 WMIC.exe Token: 35 400 WMIC.exe Token: 36 400 WMIC.exe Token: SeIncreaseQuotaPrivilege 400 WMIC.exe Token: SeSecurityPrivilege 400 WMIC.exe Token: SeTakeOwnershipPrivilege 400 WMIC.exe Token: SeLoadDriverPrivilege 400 WMIC.exe Token: SeSystemProfilePrivilege 400 WMIC.exe Token: SeSystemtimePrivilege 400 WMIC.exe Token: SeProfSingleProcessPrivilege 400 WMIC.exe Token: SeIncBasePriorityPrivilege 400 WMIC.exe Token: SeCreatePagefilePrivilege 400 WMIC.exe Token: SeBackupPrivilege 400 WMIC.exe Token: SeRestorePrivilege 400 WMIC.exe Token: SeShutdownPrivilege 400 WMIC.exe Token: SeDebugPrivilege 400 WMIC.exe Token: SeSystemEnvironmentPrivilege 400 WMIC.exe Token: SeRemoteShutdownPrivilege 400 WMIC.exe Token: SeUndockPrivilege 400 WMIC.exe Token: SeManageVolumePrivilege 400 WMIC.exe Token: 33 400 WMIC.exe Token: 34 400 WMIC.exe Token: 35 400 WMIC.exe Token: 36 400 WMIC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4460 wrote to memory of 1592 4460 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe 93 PID 4460 wrote to memory of 1592 4460 63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe 93 PID 1592 wrote to memory of 400 1592 cmd.exe 95 PID 1592 wrote to memory of 400 1592 cmd.exe 95 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe"C:\Users\Admin\AppData\Local\Temp\63061a372c41f5797f18dfeed166ec350e4029c46ad3c42ff79b8e284eb65ad6.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A6C0CF18-2D40-4C7A-9249-7D5BB9CE2371}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A6C0CF18-2D40-4C7A-9249-7D5BB9CE2371}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:400
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
867B
MD53e9c3d04dab03530e2fc91b2370118b7
SHA1e14b473b8415a54cdd0df5fce4fc2eb329145e86
SHA256f4f6cc9d015f28fd0ee1ba639bd2770ef6cc6fa07d270e4df29f0d150d2e5605
SHA51278d4db2f29afce504808f0621257d01240df5fb873775c6f44389a788ac39fd72a8fee3e76ea8d7fa5e5dc8a5eedcf95d170323a97a907dbd9d6c69ab6a9389b