Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe
- Size 525KB
- Sample260703-e2mf5sbt7z
- SHA256 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0
- MD5 11e6b56c5a60eca7c0c134d9242db102
- SHA1 9988346b6180c9c3969171e517fdd16db333efd5
- SHA512 cac35671573f6fb1b5cea5d9038e50333e19debc0b44b8fc28c84b7826757e6bd8ff6f47cb18c8ca11fcb66c43a180209e3c6013fa968faf4393f1013f6a36a6
- SSDEEP 12288:9hBSpeD+wnIegXScIqoql6hcWSsQsbH3r:9hmDKKXSaWasnb
- TLSH T119B47C47F6A591FCD05AC078834A9673FA33B88A0631B9BF03E44B302E65E555F1DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\README_DECRYPT.txt
Ransom Note
- YOUR FILES HAVE BEEN ENCRYPTED All your important files have been encrypted using RSA-2048 encryption. Attempting to decrypt files without the private key will result in permanent data loss. TO RECOVER YOUR FILES: 1. Contact us via Session app. You can download it from here, it's free and secure: https://getsession.org 2. Contact us with this ID: 05bd51745f37597905bc59249cff25569c357296ede1b0d2214215a09b6448816e 3. Provide your unique ID: franciscoimoveis WARNING: - Do not modify encrypted files - Do not attempt to use recovery tools. This will cause the files to be permanently destroyed. Onion Link: http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion
URLs
-
https://getsession.org
-
http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion
Signatures
- Clears Windows event logs 1 TTPs 16 IoCs
pid Process 3912 wevtutil.exe 5572 wevtutil.exe 3688 wevtutil.exe 2176 wevtutil.exe 2208 wevtutil.exe 4232 wevtutil.exe 4240 wevtutil.exe 6076 wevtutil.exe 868 wevtutil.exe 5160 wevtutil.exe 1924 wevtutil.exe 3240 wevtutil.exe 2532 wevtutil.exe 1044 wevtutil.exe 5132 wevtutil.exe 4512 wevtutil.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\THMBNAIL.PNG.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\logo_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview2x.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\VisualElements\Logo.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\LogoDev.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\SmallLogo.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\Retail\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\accessibility_poster.jpg.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.jpg.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner-2x.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\v8_context_snapshot.bin.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_hiContrast_wob.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3604 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 2696 vssvc.exe Token: SeRestorePrivilege 2696 vssvc.exe Token: SeAuditPrivilege 2696 vssvc.exe Token: SeSecurityPrivilege 2208 wevtutil.exe Token: SeBackupPrivilege 2208 wevtutil.exe Token: SeSecurityPrivilege 3912 wevtutil.exe Token: SeBackupPrivilege 3912 wevtutil.exe Token: SeSecurityPrivilege 5572 wevtutil.exe Token: SeBackupPrivilege 5572 wevtutil.exe Token: SeSecurityPrivilege 3688 wevtutil.exe Token: SeBackupPrivilege 3688 wevtutil.exe Token: SeSecurityPrivilege 2532 wevtutil.exe Token: SeBackupPrivilege 2532 wevtutil.exe Token: SeSecurityPrivilege 1044 wevtutil.exe Token: SeBackupPrivilege 1044 wevtutil.exe Token: SeSecurityPrivilege 2176 wevtutil.exe Token: SeBackupPrivilege 2176 wevtutil.exe Token: SeSecurityPrivilege 868 wevtutil.exe Token: SeBackupPrivilege 868 wevtutil.exe Token: SeSecurityPrivilege 5132 wevtutil.exe Token: SeBackupPrivilege 5132 wevtutil.exe Token: SeSecurityPrivilege 5160 wevtutil.exe Token: SeBackupPrivilege 5160 wevtutil.exe Token: SeSecurityPrivilege 1924 wevtutil.exe Token: SeBackupPrivilege 1924 wevtutil.exe Token: SeSecurityPrivilege 4512 wevtutil.exe Token: SeBackupPrivilege 4512 wevtutil.exe Token: SeSecurityPrivilege 4232 wevtutil.exe Token: SeBackupPrivilege 4232 wevtutil.exe Token: SeSecurityPrivilege 4240 wevtutil.exe Token: SeBackupPrivilege 4240 wevtutil.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4896 wrote to memory of 3604 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 100 PID 4896 wrote to memory of 2208 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 103 PID 4896 wrote to memory of 3912 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 105 PID 4896 wrote to memory of 5572 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 108 PID 4896 wrote to memory of 3688 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 110 PID 4896 wrote to memory of 2532 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 113 PID 4896 wrote to memory of 1044 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 115 PID 4896 wrote to memory of 2176 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 117 PID 4896 wrote to memory of 868 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 119 PID 4896 wrote to memory of 5132 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 121 PID 4896 wrote to memory of 5160 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 123 PID 4896 wrote to memory of 1924 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 125 PID 4896 wrote to memory of 4512 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 127 PID 4896 wrote to memory of 4232 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 129 PID 4896 wrote to memory of 4240 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 131 PID 4896 wrote to memory of 3240 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 133 PID 4896 wrote to memory of 6076 4896 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 135 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe"C:\Users\Admin\AppData\Local\Temp\e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\system32\vssadmin.exe"vssadmin" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3604
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Application2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl System2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5572
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Setup2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-PowerShell/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl "Windows PowerShell"2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-TaskScheduler/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5132
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5160
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-SmbClient/Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-SmbServer/Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-WMI-Activity/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-Sysmon/Operational2⤵
- Clears Windows event logs
PID:3240
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-Bits-Client/Operational2⤵
- Clears Windows event logs
PID:6076
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\NewSend.bat" "1⤵PID:3788
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\README_DECRYPT.txt
- Size 682B
- SHA256 643415a2c82394af7fd3d05a8382eee3bd081ad26d78fd4475e3256bbd6d83c0
- MD5 0bdeac272f73de141bf45d6ffde64e70
- SHA1 418f919f113e3a343b8cec3193561c166f5478f4
- SHA512 2bd3f8485fe7a45f209783b3aa3ab6f784fdbf192349914e239c5117f94a28d5b1913108e923c498041cab6dc72d75bcf50123fcbaa439948f58fefa0f134805
- TLSH T13701885F5E90DC05465152F5BE1CD721DBD15A0C33606553B0588CC811CEF47ADD5DF4
- MD5 SHA1 SHA512 TLSH