a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
Size

514KB
MD5

d57c0e39087d67b6d397ca2c738e38e1
SHA1

11d1507651e6c2e25ff0a78febe0f06f5c1419c0
SHA256

a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692
SHA512

dbda08c451fc029e98e27a36fa6e654558a576b8c249e6e1cbe0a94ba4b3158d992c524c8f9e22a00247c9578d6a8601550b6c531423227daff262c98c3238c4
SSDEEP

3072:bwaXfbBI4++rye6iLfMzmlOe4UKXqlc8Lm87wgZPzOmem0Oa9G8Y3:RXzin6MUKXSL/hLOH/

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 8 IoCs

Processes:

a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe

description	ioc	Process
File opened for modification	C:\Program Files\EnableReset.tif	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
File opened for modification	C:\Program Files\ExitLimit.ttf	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
File opened for modification	C:\Program Files\ExportResolve.raw	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
File created	C:\Program Files\readme.txt	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
File opened for modification	C:\Program Files\ClearEnter.rar	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
File opened for modification	C:\Program Files\ClearGrant.m1v	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
File opened for modification	C:\Program Files\ConvertInvoke.asp	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
File opened for modification	C:\Program Files\EnableJoin.xlsx	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
880	1992	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe

pid	Process
1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

vssvc.exeWMIC.exeWMIC.exe

description	pid	Process
Token: SeBackupPrivilege	2724	vssvc.exe
Token: SeRestorePrivilege	2724	vssvc.exe
Token: SeAuditPrivilege	2724	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2764	WMIC.exe
Token: SeSecurityPrivilege	2764	WMIC.exe
Token: SeTakeOwnershipPrivilege	2764	WMIC.exe
Token: SeLoadDriverPrivilege	2764	WMIC.exe
Token: SeSystemProfilePrivilege	2764	WMIC.exe
Token: SeSystemtimePrivilege	2764	WMIC.exe
Token: SeProfSingleProcessPrivilege	2764	WMIC.exe
Token: SeIncBasePriorityPrivilege	2764	WMIC.exe
Token: SeCreatePagefilePrivilege	2764	WMIC.exe
Token: SeBackupPrivilege	2764	WMIC.exe
Token: SeRestorePrivilege	2764	WMIC.exe
Token: SeShutdownPrivilege	2764	WMIC.exe
Token: SeDebugPrivilege	2764	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2764	WMIC.exe
Token: SeRemoteShutdownPrivilege	2764	WMIC.exe
Token: SeUndockPrivilege	2764	WMIC.exe
Token: SeManageVolumePrivilege	2764	WMIC.exe
Token: 33	2764	WMIC.exe
Token: 34	2764	WMIC.exe
Token: 35	2764	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2764	WMIC.exe
Token: SeSecurityPrivilege	2764	WMIC.exe
Token: SeTakeOwnershipPrivilege	2764	WMIC.exe
Token: SeLoadDriverPrivilege	2764	WMIC.exe
Token: SeSystemProfilePrivilege	2764	WMIC.exe
Token: SeSystemtimePrivilege	2764	WMIC.exe
Token: SeProfSingleProcessPrivilege	2764	WMIC.exe
Token: SeIncBasePriorityPrivilege	2764	WMIC.exe
Token: SeCreatePagefilePrivilege	2764	WMIC.exe
Token: SeBackupPrivilege	2764	WMIC.exe
Token: SeRestorePrivilege	2764	WMIC.exe
Token: SeShutdownPrivilege	2764	WMIC.exe
Token: SeDebugPrivilege	2764	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2764	WMIC.exe
Token: SeRemoteShutdownPrivilege	2764	WMIC.exe
Token: SeUndockPrivilege	2764	WMIC.exe
Token: SeManageVolumePrivilege	2764	WMIC.exe
Token: 33	2764	WMIC.exe
Token: 34	2764	WMIC.exe
Token: 35	2764	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2892	WMIC.exe
Token: SeSecurityPrivilege	2892	WMIC.exe
Token: SeTakeOwnershipPrivilege	2892	WMIC.exe
Token: SeLoadDriverPrivilege	2892	WMIC.exe
Token: SeSystemProfilePrivilege	2892	WMIC.exe
Token: SeSystemtimePrivilege	2892	WMIC.exe
Token: SeProfSingleProcessPrivilege	2892	WMIC.exe
Token: SeIncBasePriorityPrivilege	2892	WMIC.exe
Token: SeCreatePagefilePrivilege	2892	WMIC.exe
Token: SeBackupPrivilege	2892	WMIC.exe
Token: SeRestorePrivilege	2892	WMIC.exe
Token: SeShutdownPrivilege	2892	WMIC.exe
Token: SeDebugPrivilege	2892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2892	WMIC.exe
Token: SeRemoteShutdownPrivilege	2892	WMIC.exe
Token: SeUndockPrivilege	2892	WMIC.exe
Token: SeManageVolumePrivilege	2892	WMIC.exe
Token: 33	2892	WMIC.exe
Token: 34	2892	WMIC.exe
Token: 35	2892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2892	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 1992 wrote to memory of 2352	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	33
PID 1992 wrote to memory of 2352	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	33
PID 1992 wrote to memory of 2352	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	33
PID 1992 wrote to memory of 2352	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	33
PID 2352 wrote to memory of 2764	2352	cmd.exe	35
PID 2352 wrote to memory of 2764	2352	cmd.exe	35
PID 2352 wrote to memory of 2764	2352	cmd.exe	35
PID 1992 wrote to memory of 2736	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	36
PID 1992 wrote to memory of 2736	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	36
PID 1992 wrote to memory of 2736	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	36
PID 1992 wrote to memory of 2736	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	36
PID 2736 wrote to memory of 2892	2736	cmd.exe	38
PID 2736 wrote to memory of 2892	2736	cmd.exe	38
PID 2736 wrote to memory of 2892	2736	cmd.exe	38
PID 1992 wrote to memory of 2640	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	39
PID 1992 wrote to memory of 2640	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	39
PID 1992 wrote to memory of 2640	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	39
PID 1992 wrote to memory of 2640	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	39
PID 2640 wrote to memory of 3068	2640	cmd.exe	41
PID 2640 wrote to memory of 3068	2640	cmd.exe	41
PID 2640 wrote to memory of 3068	2640	cmd.exe	41
PID 1992 wrote to memory of 2064	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	42
PID 1992 wrote to memory of 2064	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	42
PID 1992 wrote to memory of 2064	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	42
PID 1992 wrote to memory of 2064	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	42
PID 2064 wrote to memory of 2916	2064	cmd.exe	44
PID 2064 wrote to memory of 2916	2064	cmd.exe	44
PID 2064 wrote to memory of 2916	2064	cmd.exe	44
PID 1992 wrote to memory of 1936	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	45
PID 1992 wrote to memory of 1936	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	45
PID 1992 wrote to memory of 1936	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	45
PID 1992 wrote to memory of 1936	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	45
PID 1936 wrote to memory of 428	1936	cmd.exe	47
PID 1936 wrote to memory of 428	1936	cmd.exe	47
PID 1936 wrote to memory of 428	1936	cmd.exe	47
PID 1992 wrote to memory of 1288	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	48
PID 1992 wrote to memory of 1288	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	48
PID 1992 wrote to memory of 1288	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	48
PID 1992 wrote to memory of 1288	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	48
PID 1288 wrote to memory of 1104	1288	cmd.exe	50
PID 1288 wrote to memory of 1104	1288	cmd.exe	50
PID 1288 wrote to memory of 1104	1288	cmd.exe	50
PID 1992 wrote to memory of 1056	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	51
PID 1992 wrote to memory of 1056	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	51
PID 1992 wrote to memory of 1056	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	51
PID 1992 wrote to memory of 1056	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	51
PID 1056 wrote to memory of 2912	1056	cmd.exe	53
PID 1056 wrote to memory of 2912	1056	cmd.exe	53
PID 1056 wrote to memory of 2912	1056	cmd.exe	53
PID 1992 wrote to memory of 2748	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	54
PID 1992 wrote to memory of 2748	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	54
PID 1992 wrote to memory of 2748	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	54
PID 1992 wrote to memory of 2748	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	54
PID 2748 wrote to memory of 2908	2748	cmd.exe	56
PID 2748 wrote to memory of 2908	2748	cmd.exe	56
PID 2748 wrote to memory of 2908	2748	cmd.exe	56
PID 1992 wrote to memory of 2384	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	57
PID 1992 wrote to memory of 2384	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	57
PID 1992 wrote to memory of 2384	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	57
PID 1992 wrote to memory of 2384	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	57
PID 2384 wrote to memory of 3060	2384	cmd.exe	59
PID 2384 wrote to memory of 3060	2384	cmd.exe	59
PID 2384 wrote to memory of 3060	2384	cmd.exe	59
PID 1992 wrote to memory of 2248	1992	a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe	60

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe
"C:\Users\Admin\AppData\Local\Temp\a64dd20cad3f3bb1ef1277b9924b2de0a40ed4e5b013db68ab59efc04d47b692.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7AA3892-E0EC-457B-8FC5-DF358387B5BE}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A7AA3892-E0EC-457B-8FC5-DF358387B5BE}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CDB775E-A5D6-452B-A56A-BA620E0F7BFD}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9CDB775E-A5D6-452B-A56A-BA620E0F7BFD}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C1EF448-F6DA-47B6-A3EB-8C0870C4A941}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C1EF448-F6DA-47B6-A3EB-8C0870C4A941}'" delete
    3⤵
    PID:3068
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{494C03C6-B7B7-4DF1-8FA1-7D53E03DDA63}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{494C03C6-B7B7-4DF1-8FA1-7D53E03DDA63}'" delete
    3⤵
    PID:2916
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F47BA72D-84E4-4D7E-BDAB-96318230ABB7}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F47BA72D-84E4-4D7E-BDAB-96318230ABB7}'" delete
    3⤵
    PID:428
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8235A2B2-EED6-4D84-9B47-CD02BB13E9C1}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8235A2B2-EED6-4D84-9B47-CD02BB13E9C1}'" delete
    3⤵
    PID:1104
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E6CBF7-34AA-420A-ACFA-78E6B16AD8C2}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{82E6CBF7-34AA-420A-ACFA-78E6B16AD8C2}'" delete
    3⤵
    PID:2912
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3CBCFC55-5255-4E65-8C94-0A792EA482BB}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{3CBCFC55-5255-4E65-8C94-0A792EA482BB}'" delete
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45E828E2-3C55-49F9-825B-E01046E2A113}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{45E828E2-3C55-49F9-825B-E01046E2A113}'" delete
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76239064-3F5F-4D70-92A4-670F55591560}'" delete
  2⤵
  PID:2248
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{76239064-3F5F-4D70-92A4-670F55591560}'" delete
    3⤵
    PID:604
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B4EF978-E9B0-41CF-AAE2-776E38E9EDCE}'" delete
  2⤵
  PID:3012
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B4EF978-E9B0-41CF-AAE2-776E38E9EDCE}'" delete
    3⤵
    PID:684
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C840305C-0D8E-4B8B-BC6D-4003520487F0}'" delete
  2⤵
  PID:2996
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{C840305C-0D8E-4B8B-BC6D-4003520487F0}'" delete
    3⤵
    PID:2216
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{048EB31A-BA93-40FE-9759-479CEEF5F9AF}'" delete
  2⤵
  PID:2368
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{048EB31A-BA93-40FE-9759-479CEEF5F9AF}'" delete
    3⤵
    PID:2416
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469E3BBE-F71A-45E0-BD8F-4D2DC75A9037}'" delete
  2⤵
  PID:2232
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{469E3BBE-F71A-45E0-BD8F-4D2DC75A9037}'" delete
    3⤵
    PID:2096
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5E3EA6-3B5A-47E4-BB20-CAD4E6A45BA5}'" delete
  2⤵
  PID:2100
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5E3EA6-3B5A-47E4-BB20-CAD4E6A45BA5}'" delete
    3⤵
    PID:824
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6FD06C77-DFAC-4B42-A173-D0BD649CD10A}'" delete
  2⤵
  PID:1728
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6FD06C77-DFAC-4B42-A173-D0BD649CD10A}'" delete
    3⤵
    PID:1368
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68983E3D-3AC8-4B20-8338-F372835B7DB4}'" delete
  2⤵
  PID:1796
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{68983E3D-3AC8-4B20-8338-F372835B7DB4}'" delete
    3⤵
    PID:760
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FB19CD29-987A-4316-B729-A682ED3D39EE}'" delete
  2⤵
  PID:1732
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{FB19CD29-987A-4316-B729-A682ED3D39EE}'" delete
    3⤵
    PID:2204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1600
  2⤵
  - Program crash
  PID:880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads