17b4d01d32c64a62e36496829da323fe308437048ca87143de7365fabd4194fd

Analysis

max time kernel
123s
max time network
130s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dma locker 4.0.exe
Size

315KB
MD5

18ef6bc988d99b2ec1e91daec2619f72
SHA1

ddb7bce5fd44d1b3a1d38dfccb8d5b23ae5ed73b
SHA256

53a0dc85e447c58cb8d7c7e00381c8548878390c7a1443326625faa2b461ebe8
SHA512

02d30a6ac6a9fddc9fe542d19284e0398e1b6b329eff0c0d1410a5568cf87fb7b3c2e7d548c111b7e0fb41e4a5aee2d14678b3be11e11bd33c39477840d1ee6a
SSDEEP

3072:uon0fbxl3q7UWEj8FBqLXtCovWZ9crTb2aa1ppUPZCvW2Zg5JpdNCympz/CpUERj:1wl3eB6XtCMWZerWDvUhCvWl5NF

Score

9^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dma locker 4.0.exesvchosd.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\svchosd.exe"	dma locker 4.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\ProgramData\\select.bat"	dma locker 4.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\svchosd.exe"	svchosd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\ProgramData\\select.bat"	svchosd.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	Process
File opened (read-only)	\??\X:	vssadmin.exe
File opened (read-only)	\??\B:	vssadmin.exe
File opened (read-only)	\??\T:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\I:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\U:	vssadmin.exe
File opened (read-only)	\??\V:	vssadmin.exe
File opened (read-only)	\??\O:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\L:	vssadmin.exe
File opened (read-only)	\??\W:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\W:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\M:	vssadmin.exe
File opened (read-only)	\??\S:	vssadmin.exe
File opened (read-only)	\??\A:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\I:	vssadmin.exe
File opened (read-only)	\??\K:	vssadmin.exe
File opened (read-only)	\??\O:	vssadmin.exe
File opened (read-only)	\??\T:	vssadmin.exe
File opened (read-only)	\??\Y:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\Q:	vssadmin.exe
File opened (read-only)	\??\X:	vssadmin.exe
File opened (read-only)	\??\L:	vssadmin.exe
File opened (read-only)	\??\Q:	vssadmin.exe
File opened (read-only)	\??\U:	vssadmin.exe
File opened (read-only)	\??\V:	vssadmin.exe
File opened (read-only)	\??\J:	vssadmin.exe
File opened (read-only)	\??\Y:	vssadmin.exe
File opened (read-only)	\??\J:	vssadmin.exe
File opened (read-only)	\??\N:	vssadmin.exe
File opened (read-only)	\??\R:	vssadmin.exe
File opened (read-only)	\??\B:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\A:	vssadmin.exe
File opened (read-only)	\??\M:	vssadmin.exe
File opened (read-only)	\??\N:	vssadmin.exe
File opened (read-only)	\??\P:	vssadmin.exe
File opened (read-only)	\??\K:	vssadmin.exe
File opened (read-only)	\??\P:	vssadmin.exe
File opened (read-only)	\??\R:	vssadmin.exe
File opened (read-only)	\??\S:	vssadmin.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

svchosd.exedma locker 4.0.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchosd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dma locker 4.0.exe

Interacts with shadow copies 3 TTPs 50 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

pid	Process
2140	vssadmin.exe
2652	vssadmin.exe
908	vssadmin.exe
1896	vssadmin.exe
3052	vssadmin.exe
1704	vssadmin.exe
1600	vssadmin.exe
1656	vssadmin.exe
692	vssadmin.exe
1824	vssadmin.exe
2344	vssadmin.exe
2120	vssadmin.exe
2716	vssadmin.exe
2056	vssadmin.exe
2916	vssadmin.exe
1836	vssadmin.exe
1072	vssadmin.exe
1404	vssadmin.exe
2444	vssadmin.exe
2204	vssadmin.exe
1144	vssadmin.exe
2300	vssadmin.exe
1972	vssadmin.exe
956	vssadmin.exe
2420	vssadmin.exe
2660	vssadmin.exe
752	vssadmin.exe
1376	vssadmin.exe
1056	vssadmin.exe
2328	vssadmin.exe
2848	vssadmin.exe
1676	vssadmin.exe
1652	vssadmin.exe
1492	vssadmin.exe
1668	vssadmin.exe
1416	vssadmin.exe
1296	vssadmin.exe
3068	vssadmin.exe
696	vssadmin.exe
2992	vssadmin.exe
204	vssadmin.exe
536	vssadmin.exe
2820	vssadmin.exe
2276	vssadmin.exe
3064	vssadmin.exe
2648	vssadmin.exe
2124	vssadmin.exe
2080	vssadmin.exe
2592	vssadmin.exe
1904	vssadmin.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

dma locker 4.0.exe

pid	Process
2572	dma locker 4.0.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description	pid	Process
Token: SeBackupPrivilege	1628	vssvc.exe
Token: SeRestorePrivilege	1628	vssvc.exe
Token: SeAuditPrivilege	1628	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dma locker 4.0.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 2572 wrote to memory of 1832	2572	dma locker 4.0.exe	31
PID 2572 wrote to memory of 1832	2572	dma locker 4.0.exe	31
PID 2572 wrote to memory of 1832	2572	dma locker 4.0.exe	31
PID 2572 wrote to memory of 1832	2572	dma locker 4.0.exe	31
PID 1832 wrote to memory of 2056	1832	cmd.exe	33
PID 1832 wrote to memory of 2056	1832	cmd.exe	33
PID 1832 wrote to memory of 2056	1832	cmd.exe	33
PID 2572 wrote to memory of 2932	2572	dma locker 4.0.exe	35
PID 2572 wrote to memory of 2932	2572	dma locker 4.0.exe	35
PID 2572 wrote to memory of 2932	2572	dma locker 4.0.exe	35
PID 2572 wrote to memory of 2932	2572	dma locker 4.0.exe	35
PID 2932 wrote to memory of 1376	2932	cmd.exe	37
PID 2932 wrote to memory of 1376	2932	cmd.exe	37
PID 2932 wrote to memory of 1376	2932	cmd.exe	37
PID 2572 wrote to memory of 2856	2572	dma locker 4.0.exe	38
PID 2572 wrote to memory of 2856	2572	dma locker 4.0.exe	38
PID 2572 wrote to memory of 2856	2572	dma locker 4.0.exe	38
PID 2572 wrote to memory of 2856	2572	dma locker 4.0.exe	38
PID 2856 wrote to memory of 3052	2856	cmd.exe	40
PID 2856 wrote to memory of 3052	2856	cmd.exe	40
PID 2856 wrote to memory of 3052	2856	cmd.exe	40
PID 2572 wrote to memory of 2744	2572	dma locker 4.0.exe	42
PID 2572 wrote to memory of 2744	2572	dma locker 4.0.exe	42
PID 2572 wrote to memory of 2744	2572	dma locker 4.0.exe	42
PID 2572 wrote to memory of 2744	2572	dma locker 4.0.exe	42
PID 2744 wrote to memory of 2648	2744	cmd.exe	44
PID 2744 wrote to memory of 2648	2744	cmd.exe	44
PID 2744 wrote to memory of 2648	2744	cmd.exe	44
PID 2572 wrote to memory of 2704	2572	dma locker 4.0.exe	45
PID 2572 wrote to memory of 2704	2572	dma locker 4.0.exe	45
PID 2572 wrote to memory of 2704	2572	dma locker 4.0.exe	45
PID 2572 wrote to memory of 2704	2572	dma locker 4.0.exe	45
PID 2704 wrote to memory of 2124	2704	cmd.exe	47
PID 2704 wrote to memory of 2124	2704	cmd.exe	47
PID 2704 wrote to memory of 2124	2704	cmd.exe	47
PID 2572 wrote to memory of 2156	2572	dma locker 4.0.exe	48
PID 2572 wrote to memory of 2156	2572	dma locker 4.0.exe	48
PID 2572 wrote to memory of 2156	2572	dma locker 4.0.exe	48
PID 2572 wrote to memory of 2156	2572	dma locker 4.0.exe	48
PID 2156 wrote to memory of 692	2156	cmd.exe	50
PID 2156 wrote to memory of 692	2156	cmd.exe	50
PID 2156 wrote to memory of 692	2156	cmd.exe	50
PID 2572 wrote to memory of 2536	2572	dma locker 4.0.exe	51
PID 2572 wrote to memory of 2536	2572	dma locker 4.0.exe	51
PID 2572 wrote to memory of 2536	2572	dma locker 4.0.exe	51
PID 2572 wrote to memory of 2536	2572	dma locker 4.0.exe	51
PID 2536 wrote to memory of 2300	2536	cmd.exe	53
PID 2536 wrote to memory of 2300	2536	cmd.exe	53
PID 2536 wrote to memory of 2300	2536	cmd.exe	53
PID 2572 wrote to memory of 1456	2572	dma locker 4.0.exe	54
PID 2572 wrote to memory of 1456	2572	dma locker 4.0.exe	54
PID 2572 wrote to memory of 1456	2572	dma locker 4.0.exe	54
PID 2572 wrote to memory of 1456	2572	dma locker 4.0.exe	54
PID 1456 wrote to memory of 1416	1456	cmd.exe	56
PID 1456 wrote to memory of 1416	1456	cmd.exe	56
PID 1456 wrote to memory of 1416	1456	cmd.exe	56
PID 2572 wrote to memory of 2976	2572	dma locker 4.0.exe	57
PID 2572 wrote to memory of 2976	2572	dma locker 4.0.exe	57
PID 2572 wrote to memory of 2976	2572	dma locker 4.0.exe	57
PID 2572 wrote to memory of 2976	2572	dma locker 4.0.exe	57
PID 2976 wrote to memory of 1972	2976	cmd.exe	59
PID 2976 wrote to memory of 1972	2976	cmd.exe	59
PID 2976 wrote to memory of 1972	2976	cmd.exe	59
PID 2572 wrote to memory of 1556	2572	dma locker 4.0.exe	60

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dma locker 4.0.exe
"C:\Users\Admin\AppData\Local\Temp\dma locker 4.0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=A: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=A: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=B: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=B: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=C: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=C: /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=D: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=D: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=E: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=E: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=F: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=F: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=G: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=G: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=H: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=H: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=I: /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=I: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=J: /all /quiet
  2⤵
  PID:1556
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=J: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=K: /all /quiet
  2⤵
  PID:1640
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=K: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=L: /all /quiet
  2⤵
  PID:828
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=L: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=M: /all /quiet
  2⤵
  PID:2244
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=M: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=N: /all /quiet
  2⤵
  PID:1944
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=N: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=O: /all /quiet
  2⤵
  PID:1204
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=O: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=P: /all /quiet
  2⤵
  PID:2004
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=P: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Q: /all /quiet
  2⤵
  PID:1160
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Q: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=R: /all /quiet
  2⤵
  PID:1476
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=R: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=S: /all /quiet
  2⤵
  PID:880
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=S: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=T: /all /quiet
  2⤵
  PID:1536
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=T: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=U: /all /quiet
  2⤵
  PID:580
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=U: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=V: /all /quiet
  2⤵
  PID:1372
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=V: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=W: /all /quiet
  2⤵
  PID:1712
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=W: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=X: /all /quiet
  2⤵
  PID:2284
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=X: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Y: /all /quiet
  2⤵
  PID:2024
- - C:\WINDOWS\system32\vssadmin.exe
    C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Y: /all /quiet
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:2344
- C:\ProgramData\svchosd.exe
  "C:\ProgramData\svchosd.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=A: /all /quiet
    3⤵
    PID:2780
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=A: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=B: /all /quiet
    3⤵
    PID:2828
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=B: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=C: /all /quiet
    3⤵
    PID:2656
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=C: /all /quiet
      4⤵
      Interacts with shadow copies
      PID:204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=D: /all /quiet
    3⤵
    PID:232
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=D: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=E: /all /quiet
    3⤵
    PID:2636
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=E: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=F: /all /quiet
    3⤵
    PID:2868
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=F: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=G: /all /quiet
    3⤵
    PID:2704
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=G: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=H: /all /quiet
    3⤵
    PID:2156
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=H: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=I: /all /quiet
    3⤵
    PID:2536
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=I: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=J: /all /quiet
    3⤵
    PID:1100
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=J: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=K: /all /quiet
    3⤵
    PID:2968
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=K: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=L: /all /quiet
    3⤵
    PID:1364
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=L: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=M: /all /quiet
    3⤵
    PID:1484
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=M: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=N: /all /quiet
    3⤵
    PID:2144
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=N: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=O: /all /quiet
    3⤵
    PID:372
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=O: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=P: /all /quiet
    3⤵
    PID:1196
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=P: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Q: /all /quiet
    3⤵
    PID:436
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Q: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=R: /all /quiet
    3⤵
    PID:1796
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=R: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=S: /all /quiet
    3⤵
    PID:1620
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=S: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=T: /all /quiet
    3⤵
    PID:2460
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=T: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=U: /all /quiet
    3⤵
    PID:336
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=U: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=V: /all /quiet
    3⤵
    PID:1468
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=V: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=W: /all /quiet
    3⤵
    PID:2464
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=W: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=X: /all /quiet
    3⤵
    PID:264
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=X: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:2276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Y: /all /quiet
    3⤵
    PID:1712
  - - C:\WINDOWS\system32\vssadmin.exe
      C:\WINDOWS\system32\vssadmin.exe delete shadows /For=Y: /all /quiet
      4⤵
      Enumerates connected drives
      Interacts with shadow copies
      PID:1668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-0-0x00000000002E0000-0x0000000000321000-memory.dmp

Filesize
260KB

Download
memory/2572-2-0x00000000002E0000-0x0000000000321000-memory.dmp

Filesize
260KB

Download
memory/2572-1-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download