Sandbox process chain shows executable launching recovery-disruption commands
A CAPE report links an analyzed executable to a shell that launched tools to delete shadow copies, change boot-recovery settings and remove the backup catalog. The process chain substantiates an attempt to impair recovery, but does not show whether the commands succeeded.
A single command shell in a CAPE sandbox report connects an analyzed executable to five Windows recovery-management commands. Its children include tools launched to delete shadow copies, alter boot-recovery settings and remove the backup catalog. The important question is not simply whether this resembles ransomware, but how much of the recovery-disruption mechanism the record actually demonstrates.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read