Analysis
-
max time kernel
60s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
18-04-2023 05:23
General
-
Target
794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
-
Size
807KB
-
MD5
540a177a21044860e104dc2b0512a524
-
SHA1
20014c52c83ed4cb87a2166ee77937684f1fbeb9
-
SHA256
794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81
-
SHA512
234d9b2c9a4b204e4962a9ba02824dfb312347a10bf642642e804b43db91786b0509022c33a671b0dc68cc89ca38841ffd33d38cefa928b8f10af298cc0beac8
-
SSDEEP
12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAZ:u4s+oT+NXBLi0rjFXvyHBlbtCZa8
Malware Config
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Modifies extensions of user files 17 IoCs
Ransomware generally changes the extension on encrypted files.
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 45 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe"C:\Users\Admin\AppData\Local\Temp\794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe"1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c wmic shadowcopy delete /nointeractive2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.execmd /c vssadmin.exe Delete Shadows /All /Quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} recoveryenabled No2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.execmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1040352102.png /f3⤵
- Sets desktop wallpaper using registry
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1011B
MD59bcb42cd18f95356b2d1a1a4de0b5aad
SHA1b03da5cab852e8fafc12a52e424ec4b10431270d
SHA2566e66527651da97c609c697e763e165eaf0fa1da104c26d311ec48fec9950ae24
SHA51285961b90024f25a20943f9ce3b3c0959ced373d7b548cfc533bb51164aa615125528352438ab43e4b285ab570268bb4ed46f861db89d29d830230b9f63b0f496
-
Filesize
32KB
MD5fb93594c806f5b3b4cc627d1cbcc9327
SHA1d4c29ca6106bad5409748e7f949ccff1b7d150cc
SHA256fbc6e6163add1cc990cc92afea4883465ab09b9eef49390eab674aab6c296fbb
SHA51273c0a84dad9854315d58fdc6a088c5fbf978dab3a2e193833afc72ddc83b1bf3d4a339310b51b96eb23934eb27e3379f3989f9502fcc882d2a298cf69282fc55
-
Filesize
7KB
MD5696f3c89816fa4e7f6b0d9b32f3fb40d
SHA1ac72491c5b793ca8cfd6c6b522303371613181cd
SHA256272601253ff2746a6c6b7e47dac459ab133cab33acff8a9db063c3279bf28e4b
SHA5124a662690fc7ebad5a3a321d913726edb5014d533ab36ae0bb295b9e3980eb985b82394afb40d486c87d373dc0da5999d914bce67a8fe473e4fce80e3379c6a74
-
Filesize
7KB
MD5696f3c89816fa4e7f6b0d9b32f3fb40d
SHA1ac72491c5b793ca8cfd6c6b522303371613181cd
SHA256272601253ff2746a6c6b7e47dac459ab133cab33acff8a9db063c3279bf28e4b
SHA5124a662690fc7ebad5a3a321d913726edb5014d533ab36ae0bb295b9e3980eb985b82394afb40d486c87d373dc0da5999d914bce67a8fe473e4fce80e3379c6a74
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1011B
MD59bcb42cd18f95356b2d1a1a4de0b5aad
SHA1b03da5cab852e8fafc12a52e424ec4b10431270d
SHA2566e66527651da97c609c697e763e165eaf0fa1da104c26d311ec48fec9950ae24
SHA51285961b90024f25a20943f9ce3b3c0959ced373d7b548cfc533bb51164aa615125528352438ab43e4b285ab570268bb4ed46f861db89d29d830230b9f63b0f496
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
512KB
