Analysis
- user interaction
yes - max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe
- Size 525KB
- Sample260703-e2mf5sbt7z
- SHA256 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0
- MD5 11e6b56c5a60eca7c0c134d9242db102
- SHA1 9988346b6180c9c3969171e517fdd16db333efd5
- SHA512 cac35671573f6fb1b5cea5d9038e50333e19debc0b44b8fc28c84b7826757e6bd8ff6f47cb18c8ca11fcb66c43a180209e3c6013fa968faf4393f1013f6a36a6
- SSDEEP 12288:9hBSpeD+wnIegXScIqoql6hcWSsQsbH3r:9hmDKKXSaWasnb
- TLSH T119B47C47F6A591FCD05AC078834A9673FA33B88A0631B9BF03E44B302E65E555F1DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\Users\Admin\README_DECRYPT.txt
Ransom Note
- YOUR FILES HAVE BEEN ENCRYPTED All your important files have been encrypted using RSA-2048 encryption. Attempting to decrypt files without the private key will result in permanent data loss. TO RECOVER YOUR FILES: 1. Contact us via Session app. You can download it from here, it's free and secure: https://getsession.org 2. Contact us with this ID: 05bd51745f37597905bc59249cff25569c357296ede1b0d2214215a09b6448816e 3. Provide your unique ID: franciscoimoveis WARNING: - Do not modify encrypted files - Do not attempt to use recovery tools. This will cause the files to be permanently destroyed. Onion Link: http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion
URLs
-
https://getsession.org
-
http://iacjvmxjb2ivqkxxzmde4w6g53gn6ym7c3g6mfifvejyhqtp4wrkypyd.onion
Signatures
- Clears Windows event logs 1 TTPs 16 IoCs
pid Process 556 wevtutil.exe 3220 wevtutil.exe 708 wevtutil.exe 6264 wevtutil.exe 6984 wevtutil.exe 2832 wevtutil.exe 3644 wevtutil.exe 1136 wevtutil.exe 6484 wevtutil.exe 6660 wevtutil.exe 3312 wevtutil.exe 2684 wevtutil.exe 2352 wevtutil.exe 5812 wevtutil.exe 4808 wevtutil.exe 244 wevtutil.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\OutlookAddrNaiveBayesCommandRanker.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\VisualElements\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-114x114-precomposed.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\standards_poster.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\THMBNAIL.PNG.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\v8_context_snapshot.bin.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\core_icons_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\faf_icons_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\redact_poster.jpg.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\THMBNAIL.PNG.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\Lang\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\THMBNAIL.PNG.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\VideoLAN\VLC\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Windows Defender\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\README_DECRYPT.txt e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe File opened for modification C:\Program Files\7-Zip\History.txt.doomag e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6952 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeBackupPrivilege 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe Token: SeSecurityPrivilege 6484 wevtutil.exe Token: SeBackupPrivilege 6484 wevtutil.exe Token: SeBackupPrivilege 3436 vssvc.exe Token: SeRestorePrivilege 3436 vssvc.exe Token: SeAuditPrivilege 3436 vssvc.exe Token: SeSecurityPrivilege 2832 wevtutil.exe Token: SeBackupPrivilege 2832 wevtutil.exe Token: SeSecurityPrivilege 2352 wevtutil.exe Token: SeBackupPrivilege 2352 wevtutil.exe Token: SeSecurityPrivilege 3644 wevtutil.exe Token: SeBackupPrivilege 3644 wevtutil.exe Token: SeSecurityPrivilege 6660 wevtutil.exe Token: SeBackupPrivilege 6660 wevtutil.exe Token: SeSecurityPrivilege 3312 wevtutil.exe Token: SeBackupPrivilege 3312 wevtutil.exe Token: SeSecurityPrivilege 5812 wevtutil.exe Token: SeBackupPrivilege 5812 wevtutil.exe Token: SeSecurityPrivilege 2684 wevtutil.exe Token: SeBackupPrivilege 2684 wevtutil.exe Token: SeSecurityPrivilege 1136 wevtutil.exe Token: SeBackupPrivilege 1136 wevtutil.exe Token: SeSecurityPrivilege 4808 wevtutil.exe Token: SeBackupPrivilege 4808 wevtutil.exe Token: SeSecurityPrivilege 244 wevtutil.exe Token: SeBackupPrivilege 244 wevtutil.exe Token: SeSecurityPrivilege 556 wevtutil.exe Token: SeBackupPrivilege 556 wevtutil.exe Token: SeSecurityPrivilege 6984 wevtutil.exe Token: SeBackupPrivilege 6984 wevtutil.exe Token: SeSecurityPrivilege 3220 wevtutil.exe Token: SeBackupPrivilege 3220 wevtutil.exe Token: SeSecurityPrivilege 708 wevtutil.exe Token: SeBackupPrivilege 708 wevtutil.exe Token: SeSecurityPrivilege 6264 wevtutil.exe Token: SeBackupPrivilege 6264 wevtutil.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4740 wrote to memory of 6952 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 89 PID 4740 wrote to memory of 6484 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 90 PID 4740 wrote to memory of 2832 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 94 PID 4740 wrote to memory of 2352 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 97 PID 4740 wrote to memory of 3644 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 99 PID 4740 wrote to memory of 6660 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 101 PID 4740 wrote to memory of 3312 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 104 PID 4740 wrote to memory of 5812 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 106 PID 4740 wrote to memory of 2684 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 108 PID 4740 wrote to memory of 1136 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 110 PID 4740 wrote to memory of 4808 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 112 PID 4740 wrote to memory of 244 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 114 PID 4740 wrote to memory of 556 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 116 PID 4740 wrote to memory of 6984 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 118 PID 4740 wrote to memory of 3220 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 120 PID 4740 wrote to memory of 708 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 122 PID 4740 wrote to memory of 6264 4740 e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe 124 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe"C:\Users\Admin\AppData\Local\Temp\e5c19b3a0461eb7e66cb638b2624c464b96223bab0d036c70f902ff6a9241fd0.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\system32\vssadmin.exe"vssadmin" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6952
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Application2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6484
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl System2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Setup2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3644
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-PowerShell/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6660
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl "Windows PowerShell"2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5812
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-TaskScheduler/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:244
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-SmbClient/Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:556
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-SmbServer/Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6984
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-WMI-Activity/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-Sysmon/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:708
-
-
C:\Windows\system32\wevtutil.exe"wevtutil" cl Microsoft-Windows-Bits-Client/Operational2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6264
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\README_DECRYPT.txt
- Size 682B
- SHA256 643415a2c82394af7fd3d05a8382eee3bd081ad26d78fd4475e3256bbd6d83c0
- MD5 0bdeac272f73de141bf45d6ffde64e70
- SHA1 418f919f113e3a343b8cec3193561c166f5478f4
- SHA512 2bd3f8485fe7a45f209783b3aa3ab6f784fdbf192349914e239c5117f94a28d5b1913108e923c498041cab6dc72d75bcf50123fcbaa439948f58fefa0f134805
- TLSH T13701885F5E90DC05465152F5BE1CD721DBD15A0C33606553B0588CC811CEF47ADD5DF4
- MD5 SHA1 SHA512 TLSH