Analysis
-
max time kernel
78s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/02/2025, 03:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe
-
Size
418KB
-
MD5
d44071f255785c73909d64f824331ebf
-
SHA1
577b110a8bfa6526b21bb728e14bd6494dc67f71
-
SHA256
ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429
-
SHA512
e15e61a88c1d93ab46f45c914957d266d12418611ba00f3e070c2f98bc2bd7d4ece112bf622ea1ec7c7505c002de6575a218f5d2ff5c69db34e93f1a22d5d7bc
-
SSDEEP
12288:FnvxplpMAX99S4B009MqyQMKNT75tfAD8xE:FvxplpMAtU4Bl9MdQFT75tIoS
Score
10/10
Malware Config
Extracted
Path
C:\Program Files (x86)\readme.txt
Family
dragonforce
Ransom Note
Hello!
Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.
--- Our communication process:
1. You contact us.
2. We send you a list of files that were stolen.
3. We decrypt 1 file to confirm that our decryptor works.
4. We agree on the amount, which must be paid using BTC.
5. We delete your files, we give you a decryptor.
6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
>>> Use this ID: 3E8936CF76973F8C3E8936CF76973F8C to begin the recovery process.
* In order to access the site, you will need Tor Browser,
you can download it from this link: https://www.torproject.org/
--- Additional contacts:
Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20
--- Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
--- Important:
If you refuse to pay or do not get in touch with us, we start publishing your files.
25/02/2025 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Signatures
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Drops desktop.ini file(s) 22 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Searches\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Documents\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Music\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Videos\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Users\Admin\Links\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSWDS_ES.LEX ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02097_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00956_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files\Microsoft Games\Minesweeper\en-US\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01171_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00116_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099145.JPG ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\uninstall.log ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files\Microsoft Games\Minesweeper\it-IT\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00160_.GIF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FINCL_02.MID ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090781.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files (x86)\Internet Explorer\de-DE\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RSWOP.ICM ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01618_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\eula.rtf ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Java\jre7\lib\calendars.properties ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\Wks9Pxy.cnv ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files (x86)\Common Files\System\es-ES\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.rll ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files\VideoLAN\VLC\locale\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00173_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD08868_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00932_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00681_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EAST_01.MID ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00276_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DAO\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\EnableRedo.aif ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SLERROR.XML ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\readme.txt ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00116_.WMF ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 1380 vssvc.exe Token: SeRestorePrivilege 1380 vssvc.exe Token: SeAuditPrivilege 1380 vssvc.exe Token: SeIncreaseQuotaPrivilege 3004 WMIC.exe Token: SeSecurityPrivilege 3004 WMIC.exe Token: SeTakeOwnershipPrivilege 3004 WMIC.exe Token: SeLoadDriverPrivilege 3004 WMIC.exe Token: SeSystemProfilePrivilege 3004 WMIC.exe Token: SeSystemtimePrivilege 3004 WMIC.exe Token: SeProfSingleProcessPrivilege 3004 WMIC.exe Token: SeIncBasePriorityPrivilege 3004 WMIC.exe Token: SeCreatePagefilePrivilege 3004 WMIC.exe Token: SeBackupPrivilege 3004 WMIC.exe Token: SeRestorePrivilege 3004 WMIC.exe Token: SeShutdownPrivilege 3004 WMIC.exe Token: SeDebugPrivilege 3004 WMIC.exe Token: SeSystemEnvironmentPrivilege 3004 WMIC.exe Token: SeRemoteShutdownPrivilege 3004 WMIC.exe Token: SeUndockPrivilege 3004 WMIC.exe Token: SeManageVolumePrivilege 3004 WMIC.exe Token: 33 3004 WMIC.exe Token: 34 3004 WMIC.exe Token: 35 3004 WMIC.exe Token: SeIncreaseQuotaPrivilege 3004 WMIC.exe Token: SeSecurityPrivilege 3004 WMIC.exe Token: SeTakeOwnershipPrivilege 3004 WMIC.exe Token: SeLoadDriverPrivilege 3004 WMIC.exe Token: SeSystemProfilePrivilege 3004 WMIC.exe Token: SeSystemtimePrivilege 3004 WMIC.exe Token: SeProfSingleProcessPrivilege 3004 WMIC.exe Token: SeIncBasePriorityPrivilege 3004 WMIC.exe Token: SeCreatePagefilePrivilege 3004 WMIC.exe Token: SeBackupPrivilege 3004 WMIC.exe Token: SeRestorePrivilege 3004 WMIC.exe Token: SeShutdownPrivilege 3004 WMIC.exe Token: SeDebugPrivilege 3004 WMIC.exe Token: SeSystemEnvironmentPrivilege 3004 WMIC.exe Token: SeRemoteShutdownPrivilege 3004 WMIC.exe Token: SeUndockPrivilege 3004 WMIC.exe Token: SeManageVolumePrivilege 3004 WMIC.exe Token: 33 3004 WMIC.exe Token: 34 3004 WMIC.exe Token: 35 3004 WMIC.exe Token: SeIncreaseQuotaPrivilege 2792 WMIC.exe Token: SeSecurityPrivilege 2792 WMIC.exe Token: SeTakeOwnershipPrivilege 2792 WMIC.exe Token: SeLoadDriverPrivilege 2792 WMIC.exe Token: SeSystemProfilePrivilege 2792 WMIC.exe Token: SeSystemtimePrivilege 2792 WMIC.exe Token: SeProfSingleProcessPrivilege 2792 WMIC.exe Token: SeIncBasePriorityPrivilege 2792 WMIC.exe Token: SeCreatePagefilePrivilege 2792 WMIC.exe Token: SeBackupPrivilege 2792 WMIC.exe Token: SeRestorePrivilege 2792 WMIC.exe Token: SeShutdownPrivilege 2792 WMIC.exe Token: SeDebugPrivilege 2792 WMIC.exe Token: SeSystemEnvironmentPrivilege 2792 WMIC.exe Token: SeRemoteShutdownPrivilege 2792 WMIC.exe Token: SeUndockPrivilege 2792 WMIC.exe Token: SeManageVolumePrivilege 2792 WMIC.exe Token: 33 2792 WMIC.exe Token: 34 2792 WMIC.exe Token: 35 2792 WMIC.exe Token: SeIncreaseQuotaPrivilege 2792 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2880 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 32 PID 2220 wrote to memory of 2880 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 32 PID 2220 wrote to memory of 2880 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 32 PID 2220 wrote to memory of 2880 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 32 PID 2880 wrote to memory of 3004 2880 cmd.exe 34 PID 2880 wrote to memory of 3004 2880 cmd.exe 34 PID 2880 wrote to memory of 3004 2880 cmd.exe 34 PID 2220 wrote to memory of 2736 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 35 PID 2220 wrote to memory of 2736 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 35 PID 2220 wrote to memory of 2736 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 35 PID 2220 wrote to memory of 2736 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 35 PID 2736 wrote to memory of 2792 2736 cmd.exe 37 PID 2736 wrote to memory of 2792 2736 cmd.exe 37 PID 2736 wrote to memory of 2792 2736 cmd.exe 37 PID 2220 wrote to memory of 2576 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 38 PID 2220 wrote to memory of 2576 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 38 PID 2220 wrote to memory of 2576 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 38 PID 2220 wrote to memory of 2576 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 38 PID 2576 wrote to memory of 1128 2576 cmd.exe 40 PID 2576 wrote to memory of 1128 2576 cmd.exe 40 PID 2576 wrote to memory of 1128 2576 cmd.exe 40 PID 2220 wrote to memory of 3048 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 41 PID 2220 wrote to memory of 3048 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 41 PID 2220 wrote to memory of 3048 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 41 PID 2220 wrote to memory of 3048 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 41 PID 3048 wrote to memory of 1032 3048 cmd.exe 43 PID 3048 wrote to memory of 1032 3048 cmd.exe 43 PID 3048 wrote to memory of 1032 3048 cmd.exe 43 PID 2220 wrote to memory of 2148 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 44 PID 2220 wrote to memory of 2148 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 44 PID 2220 wrote to memory of 2148 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 44 PID 2220 wrote to memory of 2148 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 44 PID 2148 wrote to memory of 1736 2148 cmd.exe 46 PID 2148 wrote to memory of 1736 2148 cmd.exe 46 PID 2148 wrote to memory of 1736 2148 cmd.exe 46 PID 2220 wrote to memory of 820 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 47 PID 2220 wrote to memory of 820 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 47 PID 2220 wrote to memory of 820 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 47 PID 2220 wrote to memory of 820 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 47 PID 820 wrote to memory of 2496 820 cmd.exe 49 PID 820 wrote to memory of 2496 820 cmd.exe 49 PID 820 wrote to memory of 2496 820 cmd.exe 49 PID 2220 wrote to memory of 2960 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 50 PID 2220 wrote to memory of 2960 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 50 PID 2220 wrote to memory of 2960 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 50 PID 2220 wrote to memory of 2960 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 50 PID 2960 wrote to memory of 2952 2960 cmd.exe 52 PID 2960 wrote to memory of 2952 2960 cmd.exe 52 PID 2960 wrote to memory of 2952 2960 cmd.exe 52 PID 2220 wrote to memory of 2280 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 53 PID 2220 wrote to memory of 2280 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 53 PID 2220 wrote to memory of 2280 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 53 PID 2220 wrote to memory of 2280 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 53 PID 2280 wrote to memory of 2300 2280 cmd.exe 55 PID 2280 wrote to memory of 2300 2280 cmd.exe 55 PID 2280 wrote to memory of 2300 2280 cmd.exe 55 PID 2220 wrote to memory of 1952 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 56 PID 2220 wrote to memory of 1952 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 56 PID 2220 wrote to memory of 1952 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 56 PID 2220 wrote to memory of 1952 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 56 PID 1952 wrote to memory of 2396 1952 cmd.exe 58 PID 1952 wrote to memory of 2396 1952 cmd.exe 58 PID 1952 wrote to memory of 2396 1952 cmd.exe 58 PID 2220 wrote to memory of 1636 2220 ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe 59 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe"C:\Users\Admin\AppData\Local\Temp\ba1be94550898eedb10eb73cb5383a2d1050e96ec4df8e0bf680d3e76a9e2429.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{096796F1-2149-464D-ACBB-03B5C167CC17}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{096796F1-2149-464D-ACBB-03B5C167CC17}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F892CD27-E23E-4515-87B3-8F8F21B9D9C9}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F892CD27-E23E-4515-87B3-8F8F21B9D9C9}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32A7D592-2541-4316-9CBA-F77BBB019FC7}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{32A7D592-2541-4316-9CBA-F77BBB019FC7}'" delete3⤵PID:1128
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4322938B-E7D8-427C-9899-D8612A7A139D}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{4322938B-E7D8-427C-9899-D8612A7A139D}'" delete3⤵PID:1032
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40688390-1826-4849-9E8B-083873315E70}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{40688390-1826-4849-9E8B-083873315E70}'" delete3⤵PID:1736
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6A7C606-A48C-4CE7-8835-04E81D7912DF}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{D6A7C606-A48C-4CE7-8835-04E81D7912DF}'" delete3⤵PID:2496
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B7D60577-15EA-4C7B-BE0B-C497017039D0}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B7D60577-15EA-4C7B-BE0B-C497017039D0}'" delete3⤵PID:2952
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BB1A373F-4301-4C27-8A7E-482A72564628}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{BB1A373F-4301-4C27-8A7E-482A72564628}'" delete3⤵PID:2300
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5A9288-DEC5-4D8F-9600-23F03936D215}'" delete2⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1E5A9288-DEC5-4D8F-9600-23F03936D215}'" delete3⤵PID:2396
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{823E0A24-E393-468F-B11F-85124724B858}'" delete2⤵PID:1636
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{823E0A24-E393-468F-B11F-85124724B858}'" delete3⤵PID:1088
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0A4CD207-FB7C-469F-9F7A-80D1BD4DFCFA}'" delete2⤵PID:2208
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0A4CD207-FB7C-469F-9F7A-80D1BD4DFCFA}'" delete3⤵PID:2464
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F64151A7-2488-4B24-9A4D-D03E41D3CAC7}'" delete2⤵PID:2192
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{F64151A7-2488-4B24-9A4D-D03E41D3CAC7}'" delete3⤵PID:2108
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A40927C3-0F96-44E1-B89A-47B10F36A0E6}'" delete2⤵PID:2084
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A40927C3-0F96-44E1-B89A-47B10F36A0E6}'" delete3⤵PID:572
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C5B9C0E-6DDC-430F-9959-B1C7BC19DF79}'" delete2⤵PID:2684
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1C5B9C0E-6DDC-430F-9959-B1C7BC19DF79}'" delete3⤵PID:1392
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E322147-06DC-47C3-8F71-A37CFEE921A2}'" delete2⤵PID:1956
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0E322147-06DC-47C3-8F71-A37CFEE921A2}'" delete3⤵PID:944
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A273B3E7-11AE-4B3C-8748-31324B458734}'" delete2⤵PID:1872
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A273B3E7-11AE-4B3C-8748-31324B458734}'" delete3⤵PID:948
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{41A049F0-5D90-4970-A62C-95EBA2C69DB2}'" delete2⤵PID:2672
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{41A049F0-5D90-4970-A62C-95EBA2C69DB2}'" delete3⤵PID:2540
-
-
-
C:\Windows\system32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E1A70E3-B89F-4CF4-95D7-7FBA75E2544E}'" delete2⤵PID:1916
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E1A70E3-B89F-4CF4-95D7-7FBA75E2544E}'" delete3⤵PID:964
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bbe65e9ef2fc18f40e1a56047f9e52a4
SHA1343220b0e37841dc002407860057eb10dbeea94d
SHA256fd091f36db2751d75cf3269aa823d80992f209f5ba508c4075922c8579979a15
SHA512c3c22373627dc10d115ea52221552d34733b35abce1ab8b708fe483e7f67077ce8b083b884015188039d3ec245c3f019be12f83c128f8deacf5e3d397ea664c7