WitFoo-Artifact ::: message={"device_id":"3810ea13b98a42adb0ff227fbaf6169f","timestamp":"2023-10-17T20:24:24Z","behavior_id":"458","filename":"setup.exe","filepath":"\\Device\\HarddiskVolume3\\Program Files (x86)\\epson\\EPSON Advanced Printer Driver 5\\TM-T88V\\TM-T88V Utility\\setup.exe","alleged_filetype":"exe","cmdline":"\"C:\\Program Files (x86)\\EPSON\\EPSON Advanced Printer Driver 5\\TM-T88V\\TM-T88V Utility\\setup.exe\" -PSM -HIDE_PROGRESS -W32:592210 -PRD:APD","scenario":"ransomware","objective":"Follow Through","tactic":"Impact","tactic_id":"TA0040","technique":"Inhibit System Recovery","technique_id":"T1490","display_name":"VolumeShadowSnapshotDeleted","description":"A process attempted to delete a Volume Shadow Snapshot.","severity":50,"confidence":60,"ioc_type":"","ioc_value":"","ioc_source":"","ioc_description":"","user_name":"fish","user_id":"S-1-12-1-942142572-1204970278-157880471-3270697999","control_graph_id":"ctg:3810ea13b98a42adb0ff227fbaf6169f:81604677450","triggering_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:4594730739079","sha256":"1a47b9ec8ffa137a49a9ee5de6dcc2037179d1b2213ae54fe3c5cbef3145ca18","md5":"eb33b049f629677d0b48ac82e1aad6d7","parent_details":{"parent_sha256":"faf27799b04c2780dc06360f77d13d0656d78658a005d7e20a44d45b4b3f2235","parent_md5":"c85df204a8fe49fc690202c5ccd27b5b","parent_cmdline":"\"C:\\Users\\STEVEN~1\\AppData\\Local\\Temp\\APD5\\Setup.exe\"  ","parent_process_graph_id":"pid:3810ea13b98a42adb0ff227fbaf6169f:4594712136312"},"pattern_disposition":1024,"pattern_disposition_details":{"indicator":false,"detect":false,"inddet_mask":false,"sensor_only":false,"rooting":false,"kill_process":false,"kill_subprocess":false,"quarantine_mstarkine":false,"quarantine_file":false,"policy_disabled":false,"kill_parent":false,"operation_blocked":true,"process_blocked":false,"registry_operation_blocked":false,"critical_process_disabled":false,"bootup_safeguard_enabled":false,"fs_operation_blocked":false,"handle_operation_downgraded":false,"kill_action_failed":false,"blocking_unsupported_or_disabled":false,"suspend_process":false,"suspend_parent":false}} ::: clientIP=90.193.120.66 ::: fileHash=1a47b9ec8ffa137a49a9ee5de6dcc2037179d1b2213ae54fe3c5cbef3145ca18 ::: fileName=setup.exe ::: filePath=\Device\HarddiskVolume3\Program Files (x86)\epson\EPSON Advanced Printer Driver 5\TM-T88V\TM-T88V Utility\setup.exe ::: userName=fish ::: clientMAC=00ffc8e92fdb ::: created_at=2023-10-17T20:24:24Z ::: streamName=Crowdstrike Detection ::: messageType=endpoint_protection_event ::: pipelineName=Crowdstrike Detection ::: severityCode=4 ::: startTimeUTC=2023-10-17T20:24:24Z ::: clientHostname=SSTEWART-LT3.undefined ::: pipelineEntrypoint=dispatch
Product: Falcon
Vendor: Crowdstrike