Analysis
- max time kernel
148s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 09:05
Behavioral task
behavioral1
Sample
2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe
- Size 28KB
- Sample260806-k2faqaxerf
- SHA256 d7805e377e19ede9fe23cae847b2e18f2a09608687add37768ec4f7ba67acda7
- MD5 7e1ebea00ee57caf1838c87f9009bd03
- SHA1 5e5da3af1007a6efeabb1fff952b7e487c2ea677
- SHA512 4395aa6aac36484bba8e81138f1bd612c51bb7b45f065ea50176664be5de23533a4c158241289dbd6669c9240f76e80af2ba80a2236c360657d3c587112a6889
- SSDEEP 384:DtWZPzzxAm1v75rhfdPxpjCG3N/ySqlZOy5o91zg9SKykg82vn:67zxAmr1lPuG30jho9S9ny382/
- TLSH T1F6D2A44477FA9A36FABF5F3869B254014B76B916DC2DD74E088D41890C32B8C8DA0B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\Users\Default\read_it.txt
Ransom Note
- Don't worry, you can recover all your files! All your files, including documents, photos, databases, and other important data, have been encrypted. What guarantees do we provide? You can send up to 3 of your encrypted files, and we will decrypt them for free. You must follow these steps to decrypt your files: 1. Contact us via our OnionMail: [email protected] (If you do not receive a response within 24 hours, check your spam folder). 2. Obtain Bitcoin: You will need to pay $500 USD in Bitcoins for the decryption. After payment is confirmed, we will send you the tool to decrypt all your files. Bitcoin Wallet Address: bc1q3vp3m5dnleszjcwhnzs5gxmcnfx9dfkl8fcny4
Emails
Signatures
- Family: Chaos
Ransomware family first seen in June 2021.
- Chaos Ransomware 2 IoCs
resource yara_rule behavioral2/memory/5840-1-0x0000000000FA0000-0x0000000000FAE000-memory.dmp family_chaos behavioral2/files/0x000e00000001c44d-17.dat family_chaos - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/5840-1-0x0000000000FA0000-0x0000000000FAE000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x000e00000001c44d-17.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables containing many references to VEEAM. Observed in ransomware 2 IoCs
resource yara_rule behavioral2/memory/5840-1-0x0000000000FA0000-0x0000000000FAE000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM behavioral2/files/0x000e00000001c44d-17.dat INDICATOR_SUSPICOUS_EXE_References_VEEAM - Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 5124 bcdedit.exe 3500 bcdedit.exe -
pid Process 4640 wbadmin.exe - Disables Task Manager via registry modification
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt svchost.exe - Executes dropped EXE 2 IoCs
pid Process 4072 svchost.exe 2408 svchost.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateTask = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" svchost.exe - Drops desktop.ini file(s) 63 IoCs
description ioc Process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Documents\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Public\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Documents\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini svchost.exe File opened for modification C:\Users\Public\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Videos\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Searches\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\Music\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Desktop\desktop.ini svchost.exe File opened for modification C:\Users\Public\Music\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Downloads\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Links\desktop.ini svchost.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini svchost.exe File opened for modification C:\Users\Public\Pictures\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini svchost.exe File opened for modification C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini svchost.exe File opened for modification C:\Users\Admin\Videos\desktop.ini svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini svchost.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3797332335-34111092-3597280141-1000\desktop.ini svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1372 cmd.exe 1568 cmd.exe 4200 cmd.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4220 vssadmin.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings svchost.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 4516 NOTEPAD.EXE - Suspicious behavior: AddClipboardFormatListener 3 IoCs
pid Process 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 4072 svchost.exe 2408 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 4072 svchost.exe 2132 WMIC.exe 2132 WMIC.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe Token: SeDebugPrivilege 4072 svchost.exe Token: SeBackupPrivilege 3948 vssvc.exe Token: SeRestorePrivilege 3948 vssvc.exe Token: SeAuditPrivilege 3948 vssvc.exe Token: SeIncreaseQuotaPrivilege 2132 WMIC.exe Token: SeSecurityPrivilege 2132 WMIC.exe Token: SeTakeOwnershipPrivilege 2132 WMIC.exe Token: SeLoadDriverPrivilege 2132 WMIC.exe Token: SeSystemProfilePrivilege 2132 WMIC.exe Token: SeSystemtimePrivilege 2132 WMIC.exe Token: SeProfSingleProcessPrivilege 2132 WMIC.exe Token: SeIncBasePriorityPrivilege 2132 WMIC.exe Token: SeCreatePagefilePrivilege 2132 WMIC.exe Token: SeBackupPrivilege 2132 WMIC.exe Token: SeRestorePrivilege 2132 WMIC.exe Token: SeShutdownPrivilege 2132 WMIC.exe Token: SeDebugPrivilege 2132 WMIC.exe Token: SeSystemEnvironmentPrivilege 2132 WMIC.exe Token: SeRemoteShutdownPrivilege 2132 WMIC.exe Token: SeUndockPrivilege 2132 WMIC.exe Token: SeManageVolumePrivilege 2132 WMIC.exe Token: 33 2132 WMIC.exe Token: 34 2132 WMIC.exe Token: 35 2132 WMIC.exe Token: 36 2132 WMIC.exe Token: SeIncreaseQuotaPrivilege 2132 WMIC.exe Token: SeSecurityPrivilege 2132 WMIC.exe Token: SeTakeOwnershipPrivilege 2132 WMIC.exe Token: SeLoadDriverPrivilege 2132 WMIC.exe Token: SeSystemProfilePrivilege 2132 WMIC.exe Token: SeSystemtimePrivilege 2132 WMIC.exe Token: SeProfSingleProcessPrivilege 2132 WMIC.exe Token: SeIncBasePriorityPrivilege 2132 WMIC.exe Token: SeCreatePagefilePrivilege 2132 WMIC.exe Token: SeBackupPrivilege 2132 WMIC.exe Token: SeRestorePrivilege 2132 WMIC.exe Token: SeShutdownPrivilege 2132 WMIC.exe Token: SeDebugPrivilege 2132 WMIC.exe Token: SeSystemEnvironmentPrivilege 2132 WMIC.exe Token: SeRemoteShutdownPrivilege 2132 WMIC.exe Token: SeUndockPrivilege 2132 WMIC.exe Token: SeManageVolumePrivilege 2132 WMIC.exe Token: 33 2132 WMIC.exe Token: 34 2132 WMIC.exe Token: 35 2132 WMIC.exe Token: 36 2132 WMIC.exe Token: SeDebugPrivilege 2408 svchost.exe Token: SeBackupPrivilege 560 wbengine.exe Token: SeRestorePrivilege 560 wbengine.exe Token: SeSecurityPrivilege 560 wbengine.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5840 wrote to memory of 4072 5840 2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe 89 PID 4072 wrote to memory of 4200 4072 svchost.exe 90 PID 4200 wrote to memory of 4220 4200 cmd.exe 92 PID 4200 wrote to memory of 2132 4200 cmd.exe 95 PID 4072 wrote to memory of 1372 4072 svchost.exe 98 PID 1372 wrote to memory of 5124 1372 cmd.exe 101 PID 1372 wrote to memory of 3500 1372 cmd.exe 102 PID 4072 wrote to memory of 1568 4072 svchost.exe 103 PID 1568 wrote to memory of 4640 1568 cmd.exe 105 PID 4072 wrote to memory of 4516 4072 svchost.exe 113 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_7e1ebea00ee57caf1838c87f9009bd03_destroyer_elex_glassworm_wannacry.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
PID:4220
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:5124
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:3500
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
PID:4640
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt3⤵
- Opens file in notepad (likely ransom note)
PID:4516
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:4248
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:844
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Windows Management Instrumentation
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\svchost.exe
- Size 28KB
- SHA256 d7805e377e19ede9fe23cae847b2e18f2a09608687add37768ec4f7ba67acda7
- MD5 7e1ebea00ee57caf1838c87f9009bd03
- SHA1 5e5da3af1007a6efeabb1fff952b7e487c2ea677
- SHA512 4395aa6aac36484bba8e81138f1bd612c51bb7b45f065ea50176664be5de23533a4c158241289dbd6669c9240f76e80af2ba80a2236c360657d3c587112a6889
- SSDEEP 384:DtWZPzzxAm1v75rhfdPxpjCG3N/ySqlZOy5o91zg9SKykg82vn:67zxAmr1lPuG30jho9S9ny382/
- TLSH T1F6D2A44477FA9A36FABF5F3869B254014B76B916DC2DD74E088D41890C32B8C8DA0B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\File Explorer.lnk
- Size 1B
- SHA256 8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1
- MD5 d1457b72c3fb323a2671125aef3eab5d
- SHA1 5bab61eb53176449e25c2c82f172b82cb13ffb9d
- SHA512 ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0
- MD5 SHA1 SHA512
- Path C:\Users\Default\read_it.txt
- Size 727B
- SHA256 49ce954af86a7413e60a4e398dc0a639c1570e80c618c6cb62096188a06dc3a0
- MD5 ef8710c4e609b9cff62968b4ea5bcf22
- SHA1 669a382fa7143b1b96cf9084ba78b9f9affbbc82
- SHA512 9c119690670bbb36f13da0c8ff80ff25dec03f67b57b6d097912718eb60ee986c6e9fd4ba777d255826096d3b24d81d36099464607e4fbdc58be17aae87c453a
- TLSH T10601DCAF7E5F19514F61248133A89C63BE0DA388E32B47633C4A833C22312231C430BC
- MD5 SHA1 SHA512 TLSH