avoslocker | bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705

General

Target

Roseland.exe
Size

807KB
MD5

19944159dfa94a1b75effd85e6b906dc
SHA1

250acf87366f4c0cf91679a0e93dfc79954f0f10
SHA256

bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705
SHA512

c791840f59c2fc906c197c43e0e1717b9504cf46177a3688ecbd4937cdbf95349d68cc1e63649b85f02df4e6990c4df4756dd8267b062ea5271dd61fc3e508b0
SSDEEP

12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYA7:u4s+oT+NXBLi0rjFXvyHBlbnCZa8

Score

10^/10

avoslocker evasion ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

7900 bcdedit.exe
9584 bcdedit.exe

pid	process
7900	bcdedit.exe
9584	bcdedit.exe

Modifies extensions of user files 5 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Roseland.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExpandDebug.crw => C:\Users\Admin\Pictures\ExpandDebug.crw.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\GroupDismount.crw => C:\Users\Admin\Pictures\GroupDismount.crw.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\HideShow.crw => C:\Users\Admin\Pictures\HideShow.crw.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\TraceBackup.png => C:\Users\Admin\Pictures\TraceBackup.png.avos2	Roseland.exe
File renamed	C:\Users\Admin\Pictures\UnprotectEdit.crw => C:\Users\Admin\Pictures\UnprotectEdit.crw.avos2	Roseland.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Roseland.exe

description ioc process

File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI Roseland.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Roseland.exe

description ioc process

File opened (read-only) \??\Z: Roseland.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Roseland.exe

description	ioc	process
File opened (read-only)	\??\Z:	Roseland.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\80944880.png"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

Roseland.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-il\GET_YOUR_FILES_BACK.txt	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg	Roseland.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-100.png	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar	Roseland.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\ui-strings.js	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sv-se\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\tr-tr\ui-strings.js	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\af_get.svg	Roseland.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview-hover.svg	Roseland.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16_altform-lightunplated.png	Roseland.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-400.png	Roseland.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar	Roseland.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\en-gb\ui-strings.js	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\delete.svg	Roseland.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-400.png	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\da-dk\ui-strings.js	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\eu-es\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ru-ru\ui-strings.js	Roseland.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetCompare.HxS	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.felix.gogo.shell_0.10.0.v201212101605.jar	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-tw\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif	Roseland.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-400.png	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml	Roseland.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar	Roseland.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\GET_YOUR_FILES_BACK.txt	Roseland.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\MLModels\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugin.js	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\fi-fi\ui-strings.js	Roseland.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png	Roseland.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fil_get.svg	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ro-ro\ui-strings.js	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ca-es\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\it-it\ui-strings.js	Roseland.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\GET_YOUR_FILES_BACK.txt	Roseland.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-200.png	Roseland.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat	Roseland.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat	Roseland.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\GET_YOUR_FILES_BACK.txt	Roseland.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\GET_YOUR_FILES_BACK.txt	Roseland.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2796 vssadmin.exe

pid	process
2796	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Roseland.exepowershell.exepowershell.exe

pid	process
1480	Roseland.exe
1480	Roseland.exe
9652	powershell.exe
9652	powershell.exe
9652	powershell.exe
9652	powershell.exe
20972	powershell.exe
20972	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Roseland.exeWMIC.exepowershell.exevssvc.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1480	Roseland.exe
Token: SeIncreaseQuotaPrivilege	10380	WMIC.exe
Token: SeSecurityPrivilege	10380	WMIC.exe
Token: SeTakeOwnershipPrivilege	10380	WMIC.exe
Token: SeLoadDriverPrivilege	10380	WMIC.exe
Token: SeSystemProfilePrivilege	10380	WMIC.exe
Token: SeSystemtimePrivilege	10380	WMIC.exe
Token: SeProfSingleProcessPrivilege	10380	WMIC.exe
Token: SeIncBasePriorityPrivilege	10380	WMIC.exe
Token: SeCreatePagefilePrivilege	10380	WMIC.exe
Token: SeBackupPrivilege	10380	WMIC.exe
Token: SeRestorePrivilege	10380	WMIC.exe
Token: SeShutdownPrivilege	10380	WMIC.exe
Token: SeDebugPrivilege	10380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	10380	WMIC.exe
Token: SeRemoteShutdownPrivilege	10380	WMIC.exe
Token: SeUndockPrivilege	10380	WMIC.exe
Token: SeManageVolumePrivilege	10380	WMIC.exe
Token: 33	10380	WMIC.exe
Token: 34	10380	WMIC.exe
Token: 35	10380	WMIC.exe
Token: 36	10380	WMIC.exe
Token: SeDebugPrivilege	9652	powershell.exe
Token: SeIncreaseQuotaPrivilege	10380	WMIC.exe
Token: SeSecurityPrivilege	10380	WMIC.exe
Token: SeTakeOwnershipPrivilege	10380	WMIC.exe
Token: SeLoadDriverPrivilege	10380	WMIC.exe
Token: SeSystemProfilePrivilege	10380	WMIC.exe
Token: SeSystemtimePrivilege	10380	WMIC.exe
Token: SeProfSingleProcessPrivilege	10380	WMIC.exe
Token: SeIncBasePriorityPrivilege	10380	WMIC.exe
Token: SeCreatePagefilePrivilege	10380	WMIC.exe
Token: SeBackupPrivilege	10380	WMIC.exe
Token: SeRestorePrivilege	10380	WMIC.exe
Token: SeShutdownPrivilege	10380	WMIC.exe
Token: SeDebugPrivilege	10380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	10380	WMIC.exe
Token: SeRemoteShutdownPrivilege	10380	WMIC.exe
Token: SeUndockPrivilege	10380	WMIC.exe
Token: SeManageVolumePrivilege	10380	WMIC.exe
Token: 33	10380	WMIC.exe
Token: 34	10380	WMIC.exe
Token: 35	10380	WMIC.exe
Token: 36	10380	WMIC.exe
Token: SeBackupPrivilege	27568	vssvc.exe
Token: SeRestorePrivilege	27568	vssvc.exe
Token: SeAuditPrivilege	27568	vssvc.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeSecurityPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeSecurityPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe
Token: SeSecurityPrivilege	9652	powershell.exe
Token: SeBackupPrivilege	9652	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

Roseland.execmd.execmd.execmd.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 1480 wrote to memory of 1296	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 1296	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 1156	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 1156	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 3624	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 3624	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 1168	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 1168	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 1020	1480	Roseland.exe	cmd.exe
PID 1480 wrote to memory of 1020	1480	Roseland.exe	cmd.exe
PID 3624 wrote to memory of 9584	3624	cmd.exe	bcdedit.exe
PID 3624 wrote to memory of 9584	3624	cmd.exe	bcdedit.exe
PID 1020 wrote to memory of 9652	1020	cmd.exe	powershell.exe
PID 1020 wrote to memory of 9652	1020	cmd.exe	powershell.exe
PID 1168 wrote to memory of 7900	1168	cmd.exe	bcdedit.exe
PID 1168 wrote to memory of 7900	1168	cmd.exe	bcdedit.exe
PID 1296 wrote to memory of 10380	1296	cmd.exe	WMIC.exe
PID 1296 wrote to memory of 10380	1296	cmd.exe	WMIC.exe
PID 1156 wrote to memory of 2796	1156	cmd.exe	vssadmin.exe
PID 1156 wrote to memory of 2796	1156	cmd.exe	vssadmin.exe
PID 1480 wrote to memory of 20972	1480	Roseland.exe	powershell.exe
PID 1480 wrote to memory of 20972	1480	Roseland.exe	powershell.exe
PID 20972 wrote to memory of 19760	20972	powershell.exe	reg.exe
PID 20972 wrote to memory of 19760	20972	powershell.exe	reg.exe
PID 20972 wrote to memory of 19980	20972	powershell.exe	rundll32.exe
PID 20972 wrote to memory of 19980	20972	powershell.exe	rundll32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Roseland.exe
"C:\Users\Admin\AppData\Local\Temp\Roseland.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:10380
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2796
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:9584
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:7900
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:9652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:20972
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\80944880.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:19760
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:19980

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:27568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
6d81ed40ba0a283e5483bfe6a448e9d7

SHA1
0c847a5f9df743b13e1aa11b4c24a4309e9a7119

SHA256
b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d

SHA512
8956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d5ec758b0f3f7a5300c0883d9749a5c6

SHA1
571a3baa5a6d8f952da3e22a27bbff9c23196764

SHA256
84c323e71d91cb5ff283f05ed017de768df8b567f16a688140a902ebb6ffcf9f

SHA512
32f1ee09bfa821dc99429093a839d267d7fec6228b2b9557b0c799bfc44819594ac9657501aaf598384a5b4da0c11386d0928cf37ad8a7335fc4325948593337

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2z2e20tv.qxl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\Device\HarddiskVolume1\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
6d81ed40ba0a283e5483bfe6a448e9d7

SHA1
0c847a5f9df743b13e1aa11b4c24a4309e9a7119

SHA256
b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d

SHA512
8956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379

Download Submit
memory/9652-24870-0x0000027A49F20000-0x0000027A49F68000-memory.dmp

Filesize
288KB

Download
memory/9652-17137-0x0000027A49F80000-0x0000027A49F90000-memory.dmp

Filesize
64KB

Download
memory/9652-14270-0x0000027A49EF0000-0x0000027A49F12000-memory.dmp

Filesize
136KB

Download
memory/9652-24885-0x0000027A49F20000-0x0000027A49F68000-memory.dmp

Filesize
288KB

Download
memory/9652-14195-0x0000027A49F80000-0x0000027A49F90000-memory.dmp

Filesize
64KB

Download
memory/9652-13501-0x0000027A49F80000-0x0000027A49F90000-memory.dmp

Filesize
64KB

Download
memory/20972-24882-0x000001A3B0B20000-0x000001A3B0B30000-memory.dmp

Filesize
64KB

Download
memory/20972-24881-0x000001A3B0B20000-0x000001A3B0B30000-memory.dmp

Filesize
64KB

Download
memory/20972-24890-0x000001A3B2920000-0x000001A3B2968000-memory.dmp

Filesize
288KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads