eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711

General

Target

eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
Size

3.5MB
MD5

733a762b6d42c5da00ebfbe66ad74ef9
SHA1

f3c60ea82d5f2bd27c77e5645bbd352f3b0043b9
SHA256

eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711
SHA512

28aa1eaa013c79600218a1d62c18539a6457fb037a32dbf584860177628b617cf97b3a744fca9c92fb64379bc211f2745df811d40d2b944776a4356fb6a95176
SSDEEP

49152:Xf+FqkHBNC5ENOqCFLyihANKcvIAgoEu2v2/Jl/mCkmhTfIeMNq1:vvkHBN4EIRy33goEu2v2xl/XkmhT4s

Score

9^/10

defense_evasion execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (215) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2348 vssadmin.exe

pid	process
2348	vssadmin.exe

Kills process with taskkill 42 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3100	taskkill.exe
3568	taskkill.exe
5028	taskkill.exe
3452	taskkill.exe
4944	taskkill.exe
3160	taskkill.exe
2332	taskkill.exe
3712	taskkill.exe
4940	taskkill.exe
1068	taskkill.exe
1988	taskkill.exe
1712	taskkill.exe
2020	taskkill.exe
1292	taskkill.exe
4008	taskkill.exe
1884	taskkill.exe
4016	taskkill.exe
2700	taskkill.exe
3504	taskkill.exe
780	taskkill.exe
3616	taskkill.exe
1320	taskkill.exe
1540	taskkill.exe
4036	taskkill.exe
2432	taskkill.exe
1228	taskkill.exe
1424	taskkill.exe
4764	taskkill.exe
2292	taskkill.exe
3980	taskkill.exe
1984	taskkill.exe
552	taskkill.exe
1612	taskkill.exe
2216	taskkill.exe
1412	taskkill.exe
1772	taskkill.exe
3584	taskkill.exe
1816	taskkill.exe
592	taskkill.exe
1940	taskkill.exe
1348	taskkill.exe
4088	taskkill.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	4008	taskkill.exe
Token: SeDebugPrivilege	1884	taskkill.exe
Token: SeDebugPrivilege	2332	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	3712	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	3452	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	1940	taskkill.exe
Token: SeDebugPrivilege	1412	taskkill.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	4944	taskkill.exe
Token: SeDebugPrivilege	3100	taskkill.exe
Token: SeDebugPrivilege	3504	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	4016	taskkill.exe
Token: SeDebugPrivilege	1068	taskkill.exe
Token: SeDebugPrivilege	1988	taskkill.exe
Token: SeDebugPrivilege	1348	taskkill.exe
Token: SeDebugPrivilege	1712	taskkill.exe
Token: SeDebugPrivilege	4036	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	2020	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	3584	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	3568	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	780	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe
Token: SeDebugPrivilege	1228	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	3160	taskkill.exe
Token: SeBackupPrivilege	4640	vssvc.exe
Token: SeRestorePrivilege	4640	vssvc.exe
Token: SeAuditPrivilege	4640	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe

description	pid	process	target process
PID 1880 wrote to memory of 4008	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4008	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1884	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1884	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2332	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2332	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3980	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3980	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3712	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3712	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4940	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4940	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3616	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3616	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1320	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1320	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3452	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3452	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1540	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1540	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2700	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2700	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1940	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1940	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1412	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1412	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1424	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1424	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4764	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4764	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4944	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4944	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3100	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3100	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3504	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3504	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2292	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2292	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4016	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4016	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1068	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1068	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1988	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1988	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1348	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1348	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1712	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1712	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4036	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4036	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4088	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 4088	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1772	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1772	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2432	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2432	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2020	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 2020	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1816	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 1816	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3584	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 3584	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 592	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe
PID 1880 wrote to memory of 592	1880	eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe	taskkill.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe
"C:\Users\Admin\AppData\Local\Temp\eb58cbfca307a9d3cfe718d772f7a53079db87bc8936023d6b7adb8cf7206711.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1880

C:\Windows\system32\taskkill.exe
taskkill /f /im sql.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Windows\system32\taskkill.exe
taskkill /f /im oracle.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\system32\taskkill.exe
taskkill /f /im ocssd.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\system32\taskkill.exe
taskkill /f /im dbsnmp.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\system32\taskkill.exe
taskkill /f /im synctime.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\system32\taskkill.exe
taskkill /f /im agntsvc.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Windows\system32\taskkill.exe
taskkill /f /im isqlplussvc.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3616

C:\Windows\system32\taskkill.exe
taskkill /f /im xfssvccon.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Windows\system32\taskkill.exe
taskkill /f /im mydesktopservice.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3452

C:\Windows\system32\taskkill.exe
taskkill /f /im ocautoupds.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\taskkill.exe
taskkill /f /im encsvc.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\taskkill.exe
taskkill /f /im firefox.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\system32\taskkill.exe
taskkill /f /im msedge.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\system32\taskkill.exe
taskkill /f /im chrome.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\taskkill.exe
taskkill /f /im yandex.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\system32\taskkill.exe
taskkill /f /im bitrix24.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\taskkill.exe
taskkill /f /im 1cv8.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\system32\taskkill.exe
taskkill /f /im 1cv7.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\system32\taskkill.exe
taskkill /f /im viber.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\system32\taskkill.exe
taskkill /f /im telegram.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\system32\taskkill.exe
taskkill /f /im whatsapp.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\taskkill.exe
taskkill /f /im tbirdconfig.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\system32\taskkill.exe
taskkill /f /im mydesktopqos.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\system32\taskkill.exe
taskkill /f /im ocomm.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\taskkill.exe
taskkill /f /im dbeng5U.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4036

C:\Windows\system32\taskkill.exe
taskkill /f /im sqbcoreservice.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Windows\system32\taskkill.exe
taskkill /f /im excel.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\system32\taskkill.exe
taskkill /f /im infopath.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\system32\taskkill.exe
taskkill /f /im msaccess.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\taskkill.exe
taskkill /f /im mspub.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\system32\taskkill.exe
taskkill /f /im onenote.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\system32\taskkill.exe
taskkill /f /im outlook.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\system32\taskkill.exe
taskkill /f /im powerpnt.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Windows\system32\taskkill.exe
taskkill /f /im steam.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\taskkill.exe
taskkill /f /im thebat.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\system32\taskkill.exe
taskkill /f /im thunderbird.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:780

C:\Windows\system32\taskkill.exe
taskkill /f /im visio.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\system32\taskkill.exe
taskkill /f /im winword.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Windows\system32\taskkill.exe
taskkill /f /im wordpad.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1228

C:\Windows\system32\taskkill.exe
taskkill /f /im notepad.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\system32\taskkill.exe
taskkill /f /im rmngr.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552

C:\Windows\system32\taskkill.exe
taskkill /f /im rphost.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:2348

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Pictures\ВОССТАНОВИТЬ ФАЙЛЫ.txt

Filesize
1KB

MD5
2b26a07be5f798730b0922d21666764c

SHA1
0ee385a9b3ba20830aadd4448e8872fcf23e5ed5

SHA256
de9283ce34c53e0c1afe4be38f4d22c8fbf9800a2539085827cdcb769e4373f8

SHA512
2a65358b6f5d34b858d4f258007076c9f2f6382a0d6f363af1daa1f2e8021db36c31273864f463f34673b5d38f5803b9fdd7dfcea109a74ffd67f05e5c33a37e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads