Edit tour

Windows Analysis Report
Update.exe

Overview

General Information

Sample name:	Update.exe
Analysis ID:	1531095
MD5:	ae0de63d46ce36491a606bd70341a63b
SHA1:	1e9d6893ec493e7a0ac565011d3aa31b0de29303
SHA256:	83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Deletes shadow drive data (may be related to ransomware)

May disable shadow drive data (uses vssadmin)

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Uses bcdedit to modify the Windows boot settings

AV process strings found (often used to terminate AV products)

Creates a process in suspended mode (likely to inject code)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Classification

Process Tree

System is w10x64

Update.exe (PID: 3408 cmdline: "C:\Users\user\Desktop\Update.exe" MD5: AE0DE63D46CE36491A606BD70341A63B)

conhost.exe (PID: 3424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1308 cmdline: "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 6396 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: B58073DB8892B67A672906C9358020EC)

bcdedit.exe (PID: 6520 cmdline: bcdedit /set {default} recoveryenabled No MD5: 74F7B84B0A547592CA63A00A8C4AD583)

bcdedit.exe (PID: 1012 cmdline: bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: 74F7B84B0A547592CA63A00A8C4AD583)

notepad.exe (PID: 6500 cmdline: "C:\Windows\System32\notepad.exe" Important.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Sigma Signatures

System Summary

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: vssadmin.exe Delete Shadows /All /Quiet, CommandLine: vssadmin.exe Delete Shadows /All /Quiet, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1308, ParentProcessName: cmd.exe, ProcessCommandLine: vssadmin.exe Delete Shadows /All /Quiet, ProcessId: 6396, ProcessName: vssadmin.exe

Source: C:\Users\user\Desktop\Update.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: Update.exe, 00000000.00000002.2433913171.0000029EF410C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: vssadmin.exe, 00000005.00000002.2041849473.00000131AC605000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exeDeleteShadows/All/Quietb"
Source: vssadmin.exe, 00000005.00000002.2041881996.00000131AC610000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet vssadmin.exe Delete Shadows /All /Quiet Winsta0\DefaultQ
Source: vssadmin.exe, 00000005.00000002.2041881996.00000131AC610000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exe Delete Shadows /All /Quiet

Source: C:\Users\user\Desktop\Update.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\On3_S1d3d_hard
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3424:120:WilError_03

Source: unknown	Process created: C:\Users\user\Desktop\Update.exe "C:\Users\user\Desktop\Update.exe"
Source: C:\Users\user\Desktop\Update.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Update.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Update.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" Important.txt
Source: C:\Users\user\Desktop\Update.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Process created: C:\Windows\System32\notepad.exe "C:\Windows\System32\notepad.exe" Important.txt	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} recoveryenabled No	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {default} bootstatuspolicy ignoreallfailures	Jump to behavior

Source: C:\Users\user\Desktop\Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: ws2_32 .dll	Jump to behavior
Source: C:\Users\user\Desktop\Update.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll	Jump to behavior
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior

Source: Update.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Update.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Update.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Update.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Update.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Update.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Update.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Update.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Update.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Update.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Update.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Update.exe, 00000000.00000002.2449119517.0000029EF6BE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: bcdedit.exe, 00000009.00000002.2044608472.0000027563588000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDROM Drive (0.0)

Source: Update.exe, 00000000.00000003.2336447958.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326170296.0000029EF9535000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2411337319.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369358833.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379220099.0000029EF95D8000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379725281.0000029EF95F9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2326294365.0000029EF95A5000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2392291814.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2385440927.0000029EF9608000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2336403888.0000029EF95C9000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2314176058.0000029EF94B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: Update.exe, 00000000.00000003.2407792150.0000029EFA6F6000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358164796.0000029EFA6D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346763038.0000029EFA699000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2431429909.0000029EFA6F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\All Users\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: Update.exe, 00000000.00000003.2362947264.0000029EFA707000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2380790543.0000029EFA727000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2358164796.0000029EFA6D7000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2370738373.0000029EFA727000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2346763038.0000029EFA699000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2379766945.0000029EFA707000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2369935101.0000029EFA707000.00000004.00000020.00020000.00000000.sdmp, Update.exe, 00000000.00000003.2429904660.0000029EFA728000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	1 Inhibit System Recovery
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	11 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531095
Start date and time:	2024-10-10 21:09:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Update.exe
Detection:	MAL
Classification:	mal68.rans.winEXE@13/1383@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\Desktop\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	6593
Entropy (8bit):	7.971288861152204
Encrypted:	false
SSDEEP:	192:j5hSvLl+lE8h+gxtyD02+UBc5FdHpLMgOLC:jrzlkEtyD2U8HpQgv
MD5:	ECA45D7B91D5B6D1D313BE702C59F999
SHA1:	7049E88633AA80888995E408569A4CD1968A0C4A
SHA-256:	F72F7F5EC819A99F4D518027A201F009081331AF426D1DFFC3341BA4F1C1A021
SHA-512:	A6D8294FF335A7E82B5FEBF0ACBB0070EABC314C2EC4FBDA1A28DA71C86C94683D7262466B91B84BCA79C137C5719558C96E2793B2FD0E65A29C7262E5C7D147
Malicious:	false
Reputation:	low
Preview:	.A\t...;\.C..7...?.0..@..L\z..'3%..L.:QT....A.....;.k...W@[g..U<6.U.6p.5.e...Rt.D...u.e.E.8...=.9~.&..@w'.W..Z#...7..c .Y..........?......d..5..o1D.z...OZ.<.."..[..i@h..'..`.u ...gd0.Bkr.......v.1._6.!#f.w.l.J......($...>....Ez......ju.x...I...\h.....T..$..0.m}...}6..Jyy....I...#...s.\.j..;.{......Wq..Z.B3.Pr,./\...).Xc....$.i.>q.]...qg1B.o.B.{...~.2.;.Zr<L........N.P?7\..W.Z...x...n._...Ir.S).:.rMK.......D=R.-.....X.#}.V,YR...."...(...J....>.=f.k....f?[D...##....E.....8....'..._<..3....J..Hy...z.EB.Q.........b>.\.....4.....k....299..(..g.p*0\|....<.............oo.V.../n.t.D.N.).....p.\|....d..(6....qx}&....{.%. ..\|?Z...V..a.4.!t>.a....k..N....j..yP........x..H. .....S9...e.E.{g.....P.d...4...j.....h..X .....C.v.v...vo.W'...L.P/..........l.,.){....].[..=..A..B...$G...P.n.\\J..:f........F.....m.p..K[..0...Re.....d..1...-[.....p&P7.....x....]..k..A.-y.].x.(...qW....9(x.8/....`.]..O..../.....6.<H3.P..)o=;.c....M.)$9v..1.X..nh...4sl.l?.=....1...0

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.747389160686745
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Update.exe
File size:	54'784 bytes
MD5:	ae0de63d46ce36491a606bd70341a63b
SHA1:	1e9d6893ec493e7a0ac565011d3aa31b0de29303
SHA256:	83cb5e8b7455fcb3b6c2d45269b08b3ae003dfed4ce8ca942cd007c1ebf17cf2
SHA512:	cba5b2e08963afb6cdca724cfb6561ac43015c67ef4b3d2de3dbbda9060b7bd70a3bc461cf2e4a3b47ab27b35c30952ac9c7aa8ca0393dbcf9170da065132852
SSDEEP:	768:kulvujToXfzMb/V5D2GhR1qNULB7zOzSgYV5lH8oT9To:ku6hR5LcYZ98
TLSH:	C533A48BA76620EDE9FDC238A5A1322BF8E035A403346BC79A55551B1B32FF4783D744
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.jz...)...)...)...(...)...(...)...(...)...(...)...)...)\..(...)...)E..)...(...)...)...)...(...)Rich...)........PE..d...!.nf...

Entrypoint:	0x140009b68
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x666EE721 [Sun Jun 16 13:22:41 2024 UTC]
TLS Callbacks:	0x400024a0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	11c39b34a9041b2a68f43cce6fd1b8f0

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc99c	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x10000	0xa2c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x12000	0xc0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xbd50	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xbe00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbc10	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb000	0x290	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9545	0x9600	dbb4b41e18345547ab347d527035ae06	False	0.39338541666666665	data	5.668269485142363	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x25ee	0x2600	e45cd2c55e93ab3b20a5a42f3f21ad2b	False	0.48530016447368424	data	5.246747165997128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe000	0x13e8	0x600	0cd07a989ede08d06b1a2188838af7ee	False	0.5091145833333334	DOS executable (block device driver)	4.745526199880493	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x10000	0xa2c	0xc00	4714d91615ee58f84cf05c903b55587d	False	0.4163411458333333	data	3.841691486404287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x1e0	0x200	c2aadcd19775aff61195ff26bac8fc62	False	0.52734375	data	4.710061382693063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x12000	0xc0	0x200	79601cc7c52dd155ec264c790033ed2e	False	0.287109375	data	2.4006653851160538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

DLL	Import
KERNEL32.dll	GetLastError, GetFileSizeEx, RtlLookupFunctionEntry, InitializeSListHead, GetSystemTimeAsFileTime, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, RtlCaptureContext
WS2_32.dll	InetPtonW
MSVCP140.dll	??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z, ?good@ios_base@std@@QEBA_NXZ, ?_Xlength_error@std@@YAXPEBD@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?uncaught_exception@std@@YA_NXZ, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
VCRUNTIME140_1.dll	__CxxFrameHandler4
VCRUNTIME140.dll	__current_exception_context, __current_exception, _CxxThrowException, __C_specific_handler, __std_exception_copy, memcpy, __std_exception_destroy, __std_terminate, memset
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode, __stdio_common_vsprintf
api-ms-win-crt-runtime-l1-1-0.dll	_register_thread_local_exe_atexit_callback, _c_exit, exit, __p___argv, _initterm_e, _initterm, _seh_filter_exe, _initialize_onexit_table, _cexit, __p___argc, _set_app_type, _exit, _crt_atexit, _register_onexit_function, _initialize_narrow_environment, _configure_narrow_argv, terminate, _get_initial_narrow_environment, _invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0.dll	wcsncmp
api-ms-win-crt-heap-l1-1-0.dll	_callnewh, malloc, free, _set_new_mode
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 21:10:39.004795074 CEST	54452	8000	192.168.2.5	192.168.1.104
Oct 10, 2024 21:10:39.009902954 CEST	8000	54452	192.168.1.104	192.168.2.5
Oct 10, 2024 21:10:39.010102034 CEST	54452	8000	192.168.2.5	192.168.1.104
Oct 10, 2024 21:10:39.010185957 CEST	54452	8000	192.168.2.5	192.168.1.104
Oct 10, 2024 21:10:39.010226011 CEST	54452	8000	192.168.2.5	192.168.1.104
Oct 10, 2024 21:10:39.015043020 CEST	8000	54452	192.168.1.104	192.168.2.5
Oct 10, 2024 21:10:39.060997009 CEST	8000	54452	192.168.1.104	192.168.2.5
Oct 10, 2024 21:11:00.383826017 CEST	8000	54452	192.168.1.104	192.168.2.5
Oct 10, 2024 21:11:00.384696007 CEST	54452	8000	192.168.2.5	192.168.1.104

Target ID:	0
Start time:	15:09:58
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Update.exe"
Imagebase:	0x7ff735a40000
File size:	54'784 bytes
MD5 hash:	AE0DE63D46CE36491A606BD70341A63B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	8
Start time:	15:09:59
Start date:	10/10/2024
Path:	C:\Windows\System32\bcdedit.exe
Wow64 process (32bit):	false
Commandline:	bcdedit /set {default} recoveryenabled No
Imagebase:	0x7ff775770000
File size:	491'864 bytes
MD5 hash:	74F7B84B0A547592CA63A00A8C4AD583
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Update.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{134D5992-5119-413B-BD5E-B3E55C542F04}mt66963475.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{21E7738E-9E7C-464F-A26E-57E448E1B335}mt11829122.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{55D36C34-EE2B-4B12-95E3-3B9912C9F2AA}mt16400647.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{662F421A-883E-43DB-AF43-FC78A00F1388}mt10000137.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{803CA066-60DE-45E2-9050-C9BE88ED69AC}mt11414620.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{843002AE-3CBB-4C1C-A7E2-B8C97FE1E0BE}mt45299826.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{9B94846E-FDF2-4F46-9C47-137E02B1DA8B}mt67739505.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\16.0\DTS\en-CH{F646D30C-89E6-4F59-BFAD-C1526B68776D}\{D5F9371A-9139-40C8-AF54-F186F8BE225A}mt16400656.png.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\pingme.txt.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user.bmp.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jones.bmp.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wct1834.tmp.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wct42C5.tmp.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wct4B1.tmp.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\wctB04C.tmp.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping.html.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0\shopping_fre.html.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.html.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\FontCache\4\CatalogCacheMetaData.xml.naso (copy)

C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.naso (copy)

Windows Analysis Report
Update.exe

Target ID:	12
Start time:	15:10:38
Start date:	10/10/2024
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\notepad.exe" Important.txt
Imagebase:	0x7ff7144b0000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.This may deny access to available backups and recovery options.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Deletion, Command: Command Execution, File: File Deletion, Process: Process Creation, Service: Service Metadata, Snapshot: Snapshot Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre