b9af69ac821a649f211c99e3edf32a76a213e9450b5e972a6cdda5758af530dd

max time kernel
131s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 16:00

Sharing

Target

SystemPropertiesProtection.exe
Size

100KB
MD5

267e5e22a40b09a9294743c111e7579d
SHA1

b8b40cbe24f77f76d61dd8978c9815624242a79b
SHA256

255716d4aa2846d43d5a43a3c2b0992886f4d0978f71969dd04c055170c3af93
SHA512

69802f5faabe648e284515855cfc8ec86f6e4bf8ccb28616b0fddb56833dc35ed3aa2a40a051a69aa26ac9d743724ebbbe2b46519cee7b8097084e533a5f6e7d
SSDEEP

1536:m1ZKtREC/rMcgEPJV+G57ThjEC0kzJP+V5J3:mHKzECTMpuDhjRVJG9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SystemPropertiesProtection.exe
"C:\Users\Admin\AppData\Local\Temp\SystemPropertiesProtection.exe"
1⤵
PID:1564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4592

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact