799c6fe504001596a28fa37f5c5fac6e4612394a764f199c6b46fdd31724d6dd

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
17/03/2025, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Size

1.4MB
MD5

5c254d25751269892b6f02d6c6384aef
SHA1

79106dd259ba5343202c2f669a0a61b10adfadff
SHA256

86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17
SHA512

ebde8f69487bf89570169fad50b494afb8859caf309bc6dde05979881100daebbcd38873277dc45f0108715f70418b3c9364909ec5a8bcb0ec2faac815a2f11e
SSDEEP

24576:lVN4zWHoN+fFqqPuD6Iedm2q3QKtgNIGqvKD9McwPDCkw6Bh0lhSMXlemqth5yR1:Fo5+fFqgdh02q3ntgNLqw9nwPDC7bODU

Score

10^/10

discovery ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Acrobat\9.0\README.txt

Ransom Note

--= No news is a good news ! =-- Your network has been breached and all your files Personal data, financial reports and important documents has been stolen , encrypted and ready to publish to public, if you willing to continue your bussines and make more money and keep bussines secret safe you need to restore your files first, And to restore all your files you have to pay the ransom in Bitcoin. don't bother your self and wast your time or make it more harder on your bussines , we developed a locker that can't be decrypted using third part decrypters . making your self geek and trying to restore the files with third part decrypter this will leads to lose all your date ! and then the even you pay the ransom can't help you to restore your files even us. to chat with us : 1 - Download tor browser https://www.torproject.org/download/ 2 - go to one of these links above http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion 3 - you will be asked for your ticket id to enter the chat this for you : TICKET ID 77565753618715415149 usefull links : #OUR TOR BLOG : http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

URLs

http://vanhelcbxqt4tqie6fuevfng2bsdtxgc7xslo2yo7nitaacdfrlpxnqd.onion

http://vanhelqmjstkvlhrjwzgjzpq422iku6wlggiz5y5r3rmfdeiaj3ljaid.onion

http://vanhelsokskrlaacilyfmtuqqa5haikubsjaokw47f3pt3uoivh6cgad.onion

http://vanheltarnbfjhuvggbncniap56dscnzz5yf6yjmxqivqmb5r2gmllad.onion

http://vanhelvuuo4k3xsiq626zkqvp6kobc2abry5wowxqysibmqs5yjh4uqd.onion

http://vanhelwmbf2bwzw7gmseg36qqm4ekc5uuhqbsew4eihzcahyq7sukzad.onion

http://vanhelxjo52qr2ixcmtjayqqrcodkuh36n7uq7q7xj23ggotyr3y72yd.onion

Signatures

Renames multiple (225) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\Web\\vhlocker.png"	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Web\vhlocker.png	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
File created	C:\Windows\Web\vhlocker.ico	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker\DefaultIcon\ = "C:\\Windows\\Web\\vhlocker.ico"	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.vanlocker\DefaultIcon	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vanlocker\DefaultIcon	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3060	NOTEPAD.EXE
2428	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
Token: SeBackupPrivilege	2408	vssvc.exe
Token: SeRestorePrivilege	2408	vssvc.exe
Token: SeAuditPrivilege	2408	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2840	WMIC.exe
Token: SeSecurityPrivilege	2840	WMIC.exe
Token: SeTakeOwnershipPrivilege	2840	WMIC.exe
Token: SeLoadDriverPrivilege	2840	WMIC.exe
Token: SeSystemProfilePrivilege	2840	WMIC.exe
Token: SeSystemtimePrivilege	2840	WMIC.exe
Token: SeProfSingleProcessPrivilege	2840	WMIC.exe
Token: SeIncBasePriorityPrivilege	2840	WMIC.exe
Token: SeCreatePagefilePrivilege	2840	WMIC.exe
Token: SeBackupPrivilege	2840	WMIC.exe
Token: SeRestorePrivilege	2840	WMIC.exe
Token: SeShutdownPrivilege	2840	WMIC.exe
Token: SeDebugPrivilege	2840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2840	WMIC.exe
Token: SeRemoteShutdownPrivilege	2840	WMIC.exe
Token: SeUndockPrivilege	2840	WMIC.exe
Token: SeManageVolumePrivilege	2840	WMIC.exe
Token: 33	2840	WMIC.exe
Token: 34	2840	WMIC.exe
Token: 35	2840	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2840	WMIC.exe
Token: SeSecurityPrivilege	2840	WMIC.exe
Token: SeTakeOwnershipPrivilege	2840	WMIC.exe
Token: SeLoadDriverPrivilege	2840	WMIC.exe
Token: SeSystemProfilePrivilege	2840	WMIC.exe
Token: SeSystemtimePrivilege	2840	WMIC.exe
Token: SeProfSingleProcessPrivilege	2840	WMIC.exe
Token: SeIncBasePriorityPrivilege	2840	WMIC.exe
Token: SeCreatePagefilePrivilege	2840	WMIC.exe
Token: SeBackupPrivilege	2840	WMIC.exe
Token: SeRestorePrivilege	2840	WMIC.exe
Token: SeShutdownPrivilege	2840	WMIC.exe
Token: SeDebugPrivilege	2840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2840	WMIC.exe
Token: SeRemoteShutdownPrivilege	2840	WMIC.exe
Token: SeUndockPrivilege	2840	WMIC.exe
Token: SeManageVolumePrivilege	2840	WMIC.exe
Token: 33	2840	WMIC.exe
Token: 34	2840	WMIC.exe
Token: 35	2840	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3060	WMIC.exe
Token: SeSecurityPrivilege	3060	WMIC.exe
Token: SeTakeOwnershipPrivilege	3060	WMIC.exe
Token: SeLoadDriverPrivilege	3060	WMIC.exe
Token: SeSystemProfilePrivilege	3060	WMIC.exe
Token: SeSystemtimePrivilege	3060	WMIC.exe
Token: SeProfSingleProcessPrivilege	3060	WMIC.exe
Token: SeIncBasePriorityPrivilege	3060	WMIC.exe
Token: SeCreatePagefilePrivilege	3060	WMIC.exe
Token: SeBackupPrivilege	3060	WMIC.exe
Token: SeRestorePrivilege	3060	WMIC.exe
Token: SeShutdownPrivilege	3060	WMIC.exe
Token: SeDebugPrivilege	3060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3060	WMIC.exe
Token: SeRemoteShutdownPrivilege	3060	WMIC.exe
Token: SeUndockPrivilege	3060	WMIC.exe
Token: SeManageVolumePrivilege	3060	WMIC.exe
Token: 33	3060	WMIC.exe
Token: 34	3060	WMIC.exe
Token: 35	3060	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1976	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	34
PID 884 wrote to memory of 1976	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	34
PID 884 wrote to memory of 1976	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	34
PID 884 wrote to memory of 1976	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	34
PID 1976 wrote to memory of 2840	1976	cmd.exe	36
PID 1976 wrote to memory of 2840	1976	cmd.exe	36
PID 1976 wrote to memory of 2840	1976	cmd.exe	36
PID 884 wrote to memory of 2772	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	37
PID 884 wrote to memory of 2772	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	37
PID 884 wrote to memory of 2772	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	37
PID 884 wrote to memory of 2772	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	37
PID 2772 wrote to memory of 3060	2772	cmd.exe	39
PID 2772 wrote to memory of 3060	2772	cmd.exe	39
PID 2772 wrote to memory of 3060	2772	cmd.exe	39
PID 884 wrote to memory of 3056	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	40
PID 884 wrote to memory of 3056	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	40
PID 884 wrote to memory of 3056	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	40
PID 884 wrote to memory of 3056	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	40
PID 3056 wrote to memory of 2972	3056	cmd.exe	42
PID 3056 wrote to memory of 2972	3056	cmd.exe	42
PID 3056 wrote to memory of 2972	3056	cmd.exe	42
PID 884 wrote to memory of 2892	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	43
PID 884 wrote to memory of 2892	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	43
PID 884 wrote to memory of 2892	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	43
PID 884 wrote to memory of 2892	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	43
PID 2892 wrote to memory of 2672	2892	cmd.exe	45
PID 2892 wrote to memory of 2672	2892	cmd.exe	45
PID 2892 wrote to memory of 2672	2892	cmd.exe	45
PID 884 wrote to memory of 2632	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	46
PID 884 wrote to memory of 2632	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	46
PID 884 wrote to memory of 2632	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	46
PID 884 wrote to memory of 2632	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	46
PID 2632 wrote to memory of 2688	2632	cmd.exe	48
PID 2632 wrote to memory of 2688	2632	cmd.exe	48
PID 2632 wrote to memory of 2688	2632	cmd.exe	48
PID 884 wrote to memory of 2896	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	49
PID 884 wrote to memory of 2896	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	49
PID 884 wrote to memory of 2896	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	49
PID 884 wrote to memory of 2896	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	49
PID 2896 wrote to memory of 764	2896	cmd.exe	51
PID 2896 wrote to memory of 764	2896	cmd.exe	51
PID 2896 wrote to memory of 764	2896	cmd.exe	51
PID 884 wrote to memory of 1784	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	52
PID 884 wrote to memory of 1784	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	52
PID 884 wrote to memory of 1784	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	52
PID 884 wrote to memory of 1784	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	52
PID 1784 wrote to memory of 2684	1784	cmd.exe	54
PID 1784 wrote to memory of 2684	1784	cmd.exe	54
PID 1784 wrote to memory of 2684	1784	cmd.exe	54
PID 884 wrote to memory of 2940	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	55
PID 884 wrote to memory of 2940	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	55
PID 884 wrote to memory of 2940	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	55
PID 884 wrote to memory of 2940	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	55
PID 2940 wrote to memory of 768	2940	cmd.exe	57
PID 2940 wrote to memory of 768	2940	cmd.exe	57
PID 2940 wrote to memory of 768	2940	cmd.exe	57
PID 884 wrote to memory of 996	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	58
PID 884 wrote to memory of 996	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	58
PID 884 wrote to memory of 996	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	58
PID 884 wrote to memory of 996	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	58
PID 996 wrote to memory of 1572	996	cmd.exe	60
PID 996 wrote to memory of 1572	996	cmd.exe	60
PID 996 wrote to memory of 1572	996	cmd.exe	60
PID 884 wrote to memory of 2284	884	86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe	61

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe
"C:\Users\Admin\AppData\Local\Temp\86d812544f8e250f1b52a4372aaab87565928d364471d115d669a8cc7ec50e17.exe"
1⤵
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9F5F91E-EA4A-412E-8696-B8B7D2A33563}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A9F5F91E-EA4A-412E-8696-B8B7D2A33563}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B1EACD82-7A7E-448E-95A1-74C24B2DA4D6}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B1EACD82-7A7E-448E-95A1-74C24B2DA4D6}'" delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{22568444-769D-4872-85FE-B7E5E7AD3999}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{22568444-769D-4872-85FE-B7E5E7AD3999}'" delete
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{51968473-E459-4D67-8359-4C0426F715EB}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{51968473-E459-4D67-8359-4C0426F715EB}'" delete
    3⤵
    PID:2672
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A66DE442-604E-4BAE-BC54-C537A0E03EF1}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{A66DE442-604E-4BAE-BC54-C537A0E03EF1}'" delete
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B31EE54-A3E4-48E7-AAD2-18FA821AE71A}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{1B31EE54-A3E4-48E7-AAD2-18FA821AE71A}'" delete
    3⤵
    PID:764
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E7F1856-32DB-4A0D-9C94-3719D4D1F5EA}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8E7F1856-32DB-4A0D-9C94-3719D4D1F5EA}'" delete
    3⤵
    PID:2684
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E8FE875-9ABE-4D2C-9D02-4A1A27409E53}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6E8FE875-9ABE-4D2C-9D02-4A1A27409E53}'" delete
    3⤵
    PID:768
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B61F5A0E-4F7C-4663-A1ED-27FA72E634D2}'" delete
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B61F5A0E-4F7C-4663-A1ED-27FA72E634D2}'" delete
    3⤵
    PID:1572
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{549F9041-BBAA-4351-AAF2-96883B38DCD0}'" delete
  2⤵
  PID:2284
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{549F9041-BBAA-4351-AAF2-96883B38DCD0}'" delete
    3⤵
    PID:1608
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C831F77-D8A4-41BF-B1BB-AB610266D615}'" delete
  2⤵
  PID:1564
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{9C831F77-D8A4-41BF-B1BB-AB610266D615}'" delete
    3⤵
    PID:2992
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{54AE64EA-5127-4216-90FA-4DF3665143F1}'" delete
  2⤵
  PID:2704
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{54AE64EA-5127-4216-90FA-4DF3665143F1}'" delete
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0BEF8F6C-0C38-4AFB-BC8A-46035E9B7A63}'" delete
  2⤵
  PID:2212
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{0BEF8F6C-0C38-4AFB-BC8A-46035E9B7A63}'" delete
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7DD8FF8B-8A5F-43E3-84B7-53D46D596BD6}'" delete
  2⤵
  PID:844
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7DD8FF8B-8A5F-43E3-84B7-53D46D596BD6}'" delete
    3⤵
    PID:444
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{27D90FD6-2C7D-4550-A1E9-30FF53CD47C3}'" delete
  2⤵
  PID:2976
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{27D90FD6-2C7D-4550-A1E9-30FF53CD47C3}'" delete
    3⤵
    PID:828
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8BD9F567-A226-49E6-9D43-B165A7AC8CA2}'" delete
  2⤵
  PID:1856
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{8BD9F567-A226-49E6-9D43-B165A7AC8CA2}'" delete
    3⤵
    PID:2504
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E808634B-95C5-4CE9-958E-7810CAB6235D}'" delete
  2⤵
  PID:892
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{E808634B-95C5-4CE9-958E-7810CAB6235D}'" delete
    3⤵
    PID:352
- C:\Windows\system32\cmd.exe
  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7066A177-4503-4ED2-876F-944C4103B719}'" delete
  2⤵
  PID:540
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{7066A177-4503-4ED2-876F-944C4103B719}'" delete
    3⤵
    PID:1268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2392

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2468

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Pictures\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3060

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Pictures\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact