Analysis
-
max time kernel
95s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17/02/2025, 15:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe
-
Size
418KB
-
MD5
b97812a2e6be54e725defbab88357fa2
-
SHA1
29baab2551064fa30fb18955ccc8f332bd68ddd4
-
SHA256
b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32
-
SHA512
922e875633f1ebb3168a1c67d6e6b0571c97a33e4f1b88a6be5fb62e2e817107d1efdbcbbf5153532f41d835a435e49df1d011e9c8b9006054ddf34da43a620a
-
SSDEEP
12288:FnvxplpMAX99S4B009MqyQMKNT7lVfAD8xE:FvxplpMAtU4Bl9MdQFT7lVIoS
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Family
dragonforce
Ransom Note
Hello!
Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.
--- Our communication process:
1. You contact us.
2. We send you a list of files that were stolen.
3. We decrypt 1 file to confirm that our decryptor works.
4. We agree on the amount, which must be paid using BTC.
5. We delete your files, we give you a decryptor.
6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
>>> Use this ID: 81F2B1C14220E50881F2B1C14220E508 to begin the recovery process.
* In order to access the site, you will need Tor Browser,
you can download it from this link: https://www.torproject.org/
--- Additional contacts:
Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20
--- Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
--- Important:
If you refuse to pay or do not get in touch with us, we start publishing your files.
24/11/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Signatures
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Drops desktop.ini file(s) 22 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Music\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Links\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Users\Admin\Videos\desktop.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00391_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01219_.GIF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Games\More Games\en-US\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0213449.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384900.JPG b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02093_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174315.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02743G.GIF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0211981.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0294989.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01565_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Services\verisign.bmp b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00438_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00256_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL01041_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Microsoft Games\Purble Place\en-US\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153302.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216600.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Common Files\System\en-US\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadox28.tlb b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01545_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099176.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02124_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00555_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152894.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239955.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02092_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Internet Explorer\en-US\eula.rtf b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SketchPadTestSchema.xml b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00141_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02039U.BMP b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Portal\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00513_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01236_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01241_.GIF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files\Common Files\Microsoft Shared\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\LICENSE b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Stationery\readme.txt b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.htm b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WPFT532.CNV b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00254_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01291_.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105298.WMF b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216112.JPG b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado28.tlb b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2896 vssvc.exe Token: SeRestorePrivilege 2896 vssvc.exe Token: SeAuditPrivilege 2896 vssvc.exe Token: SeIncreaseQuotaPrivilege 2144 WMIC.exe Token: SeSecurityPrivilege 2144 WMIC.exe Token: SeTakeOwnershipPrivilege 2144 WMIC.exe Token: SeLoadDriverPrivilege 2144 WMIC.exe Token: SeSystemProfilePrivilege 2144 WMIC.exe Token: SeSystemtimePrivilege 2144 WMIC.exe Token: SeProfSingleProcessPrivilege 2144 WMIC.exe Token: SeIncBasePriorityPrivilege 2144 WMIC.exe Token: SeCreatePagefilePrivilege 2144 WMIC.exe Token: SeBackupPrivilege 2144 WMIC.exe Token: SeRestorePrivilege 2144 WMIC.exe Token: SeShutdownPrivilege 2144 WMIC.exe Token: SeDebugPrivilege 2144 WMIC.exe Token: SeSystemEnvironmentPrivilege 2144 WMIC.exe Token: SeRemoteShutdownPrivilege 2144 WMIC.exe Token: SeUndockPrivilege 2144 WMIC.exe Token: SeManageVolumePrivilege 2144 WMIC.exe Token: 33 2144 WMIC.exe Token: 34 2144 WMIC.exe Token: 35 2144 WMIC.exe Token: SeIncreaseQuotaPrivilege 2144 WMIC.exe Token: SeSecurityPrivilege 2144 WMIC.exe Token: SeTakeOwnershipPrivilege 2144 WMIC.exe Token: SeLoadDriverPrivilege 2144 WMIC.exe Token: SeSystemProfilePrivilege 2144 WMIC.exe Token: SeSystemtimePrivilege 2144 WMIC.exe Token: SeProfSingleProcessPrivilege 2144 WMIC.exe Token: SeIncBasePriorityPrivilege 2144 WMIC.exe Token: SeCreatePagefilePrivilege 2144 WMIC.exe Token: SeBackupPrivilege 2144 WMIC.exe Token: SeRestorePrivilege 2144 WMIC.exe Token: SeShutdownPrivilege 2144 WMIC.exe Token: SeDebugPrivilege 2144 WMIC.exe Token: SeSystemEnvironmentPrivilege 2144 WMIC.exe Token: SeRemoteShutdownPrivilege 2144 WMIC.exe Token: SeUndockPrivilege 2144 WMIC.exe Token: SeManageVolumePrivilege 2144 WMIC.exe Token: 33 2144 WMIC.exe Token: 34 2144 WMIC.exe Token: 35 2144 WMIC.exe Token: SeIncreaseQuotaPrivilege 2928 WMIC.exe Token: SeSecurityPrivilege 2928 WMIC.exe Token: SeTakeOwnershipPrivilege 2928 WMIC.exe Token: SeLoadDriverPrivilege 2928 WMIC.exe Token: SeSystemProfilePrivilege 2928 WMIC.exe Token: SeSystemtimePrivilege 2928 WMIC.exe Token: SeProfSingleProcessPrivilege 2928 WMIC.exe Token: SeIncBasePriorityPrivilege 2928 WMIC.exe Token: SeCreatePagefilePrivilege 2928 WMIC.exe Token: SeBackupPrivilege 2928 WMIC.exe Token: SeRestorePrivilege 2928 WMIC.exe Token: SeShutdownPrivilege 2928 WMIC.exe Token: SeDebugPrivilege 2928 WMIC.exe Token: SeSystemEnvironmentPrivilege 2928 WMIC.exe Token: SeRemoteShutdownPrivilege 2928 WMIC.exe Token: SeUndockPrivilege 2928 WMIC.exe Token: SeManageVolumePrivilege 2928 WMIC.exe Token: 33 2928 WMIC.exe Token: 34 2928 WMIC.exe Token: 35 2928 WMIC.exe Token: SeIncreaseQuotaPrivilege 2928 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 108 wrote to memory of 2824 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 108 wrote to memory of 2824 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 108 wrote to memory of 2824 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 108 wrote to memory of 2824 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 32 PID 2824 wrote to memory of 2144 2824 cmd.exe 34 PID 2824 wrote to memory of 2144 2824 cmd.exe 34 PID 2824 wrote to memory of 2144 2824 cmd.exe 34 PID 108 wrote to memory of 3056 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 108 wrote to memory of 3056 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 108 wrote to memory of 3056 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 108 wrote to memory of 3056 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 35 PID 3056 wrote to memory of 2928 3056 cmd.exe 37 PID 3056 wrote to memory of 2928 3056 cmd.exe 37 PID 3056 wrote to memory of 2928 3056 cmd.exe 37 PID 108 wrote to memory of 2748 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 108 wrote to memory of 2748 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 108 wrote to memory of 2748 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 108 wrote to memory of 2748 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 38 PID 2748 wrote to memory of 2700 2748 cmd.exe 40 PID 2748 wrote to memory of 2700 2748 cmd.exe 40 PID 2748 wrote to memory of 2700 2748 cmd.exe 40 PID 108 wrote to memory of 2764 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 108 wrote to memory of 2764 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 108 wrote to memory of 2764 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 108 wrote to memory of 2764 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 41 PID 2764 wrote to memory of 2292 2764 cmd.exe 43 PID 2764 wrote to memory of 2292 2764 cmd.exe 43 PID 2764 wrote to memory of 2292 2764 cmd.exe 43 PID 108 wrote to memory of 1656 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 108 wrote to memory of 1656 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 108 wrote to memory of 1656 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 108 wrote to memory of 1656 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 44 PID 1656 wrote to memory of 2056 1656 cmd.exe 46 PID 1656 wrote to memory of 2056 1656 cmd.exe 46 PID 1656 wrote to memory of 2056 1656 cmd.exe 46 PID 108 wrote to memory of 3016 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 108 wrote to memory of 3016 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 108 wrote to memory of 3016 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 108 wrote to memory of 3016 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 47 PID 3016 wrote to memory of 3000 3016 cmd.exe 49 PID 3016 wrote to memory of 3000 3016 cmd.exe 49 PID 3016 wrote to memory of 3000 3016 cmd.exe 49 PID 108 wrote to memory of 2092 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 108 wrote to memory of 2092 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 108 wrote to memory of 2092 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 108 wrote to memory of 2092 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 50 PID 2092 wrote to memory of 2312 2092 cmd.exe 52 PID 2092 wrote to memory of 2312 2092 cmd.exe 52 PID 2092 wrote to memory of 2312 2092 cmd.exe 52 PID 108 wrote to memory of 2320 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 108 wrote to memory of 2320 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 108 wrote to memory of 2320 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 108 wrote to memory of 2320 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 53 PID 2320 wrote to memory of 816 2320 cmd.exe 55 PID 2320 wrote to memory of 816 2320 cmd.exe 55 PID 2320 wrote to memory of 816 2320 cmd.exe 55 PID 108 wrote to memory of 236 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 108 wrote to memory of 236 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 108 wrote to memory of 236 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 108 wrote to memory of 236 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 56 PID 236 wrote to memory of 3028 236 cmd.exe 58 PID 236 wrote to memory of 3028 236 cmd.exe 58 PID 236 wrote to memory of 3028 236 cmd.exe 58 PID 108 wrote to memory of 2500 108 b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe 59 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe"C:\Users\Admin\AppData\Local\Temp\b9bba02d18bacc4bc8d9e4f70657d381568075590cc9d0e7590327d854224b32.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{096796F1-2149-464D-ACBB-03B5C167CC17}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{096796F1-2149-464D-ACBB-03B5C167CC17}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F892CD27-E23E-4515-87B3-8F8F21B9D9C9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F892CD27-E23E-4515-87B3-8F8F21B9D9C9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32A7D592-2541-4316-9CBA-F77BBB019FC7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32A7D592-2541-4316-9CBA-F77BBB019FC7}'" delete3⤵PID:2700
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4322938B-E7D8-427C-9899-D8612A7A139D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4322938B-E7D8-427C-9899-D8612A7A139D}'" delete3⤵PID:2292
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40688390-1826-4849-9E8B-083873315E70}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40688390-1826-4849-9E8B-083873315E70}'" delete3⤵PID:2056
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6A7C606-A48C-4CE7-8835-04E81D7912DF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6A7C606-A48C-4CE7-8835-04E81D7912DF}'" delete3⤵PID:3000
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B7D60577-15EA-4C7B-BE0B-C497017039D0}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B7D60577-15EA-4C7B-BE0B-C497017039D0}'" delete3⤵PID:2312
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BB1A373F-4301-4C27-8A7E-482A72564628}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BB1A373F-4301-4C27-8A7E-482A72564628}'" delete3⤵PID:816
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5A9288-DEC5-4D8F-9600-23F03936D215}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5A9288-DEC5-4D8F-9600-23F03936D215}'" delete3⤵PID:3028
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{823E0A24-E393-468F-B11F-85124724B858}'" delete2⤵PID:2500
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{823E0A24-E393-468F-B11F-85124724B858}'" delete3⤵PID:1640
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0A4CD207-FB7C-469F-9F7A-80D1BD4DFCFA}'" delete2⤵PID:1632
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0A4CD207-FB7C-469F-9F7A-80D1BD4DFCFA}'" delete3⤵PID:1408
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F64151A7-2488-4B24-9A4D-D03E41D3CAC7}'" delete2⤵PID:2452
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F64151A7-2488-4B24-9A4D-D03E41D3CAC7}'" delete3⤵PID:1720
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A40927C3-0F96-44E1-B89A-47B10F36A0E6}'" delete2⤵PID:2260
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A40927C3-0F96-44E1-B89A-47B10F36A0E6}'" delete3⤵PID:2416
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C5B9C0E-6DDC-430F-9959-B1C7BC19DF79}'" delete2⤵PID:592
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C5B9C0E-6DDC-430F-9959-B1C7BC19DF79}'" delete3⤵PID:1932
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E322147-06DC-47C3-8F71-A37CFEE921A2}'" delete2⤵PID:2592
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E322147-06DC-47C3-8F71-A37CFEE921A2}'" delete3⤵PID:1652
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A273B3E7-11AE-4B3C-8748-31324B458734}'" delete2⤵PID:2240
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A273B3E7-11AE-4B3C-8748-31324B458734}'" delete3⤵PID:2272
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{41A049F0-5D90-4970-A62C-95EBA2C69DB2}'" delete2⤵PID:964
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{41A049F0-5D90-4970-A62C-95EBA2C69DB2}'" delete3⤵PID:1728
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E1A70E3-B89F-4CF4-95D7-7FBA75E2544E}'" delete2⤵PID:456
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E1A70E3-B89F-4CF4-95D7-7FBA75E2544E}'" delete3⤵PID:1784
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5960d3a0f2b4f17e9220820060482dc
SHA184163d5b0ca469c80e7ca9f354be6a06b3fdf474
SHA25680992369c2e7fb7440f6a9fda3ba9fc6f06dc726f073d62eda61c8d27b50cf52
SHA512341f4221621e886b074d628c8d5a3614c1a855ef1533dc8869b17a0df155c33c7f75a09f394041e2e8c410a8786d4b01053454af756438040b86220fd6bfd74e