Ransomware-related file encryption activity on file server
🛡️ ProPera Intelligence background analysis - no action needed to view
⏳
Correlating behaviour, intelligence and relationships…Details
Incident IDINC-01002 (1002)
Created2026-08-17 20:07 UTC
Last updated2026-08-17 22:07 UTC
Assigned to-
Tagsransomware
SourceDemo
Alerts1
Devices & Users
Devicescorp-srv-file01
Userssvc-backup@propera.local
DeterminationUnknown
Alerts in this incident 1
| Alert | Severity | Status | Category | Device | User | MITRE |
|---|---|---|---|---|---|---|
| Multiple files encrypted with unknown extension | Critical | New | Ransomware | corp-srv-file01 | svc-backup@propera.local | T1486T1490 |
Evidence timeline
20:07:49 UTC · File
Encrypted file created
D:\Shares\Finance\finance_q3.xlsx.lockbit
20:07:49 UTC · Process
Encryption process
encryptor.exe --target D:\Shares
C:\Windows\Temp\encryptor.exe
20:07:49 UTC · Registry
Shadow copy deletion (vssadmin)
vssadmin.exe delete shadows /all /quiet
Comments & updates
💬
No comments yet.Update incident
