avoslocker | 794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81

General

Target

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
Size

807KB
MD5

540a177a21044860e104dc2b0512a524
SHA1

20014c52c83ed4cb87a2166ee77937684f1fbeb9
SHA256

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81
SHA512

234d9b2c9a4b204e4962a9ba02824dfb312347a10bf642642e804b43db91786b0509022c33a671b0dc68cc89ca38841ffd33d38cefa928b8f10af298cc0beac8
SSDEEP

12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAZ:u4s+oT+NXBLi0rjFXvyHBlbtCZa8

Score

10^/10

avoslocker evasion ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2472 bcdedit.exe
2888 bcdedit.exe

pid	process
2472	bcdedit.exe
2888	bcdedit.exe

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\UnregisterComplete.tiff	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\ApproveNew.png => C:\Users\Admin\Pictures\ApproveNew.png.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\UnprotectClose.raw => C:\Users\Admin\Pictures\UnprotectClose.raw.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\AddUninstall.raw => C:\Users\Admin\Pictures\AddUninstall.raw.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmRead.tiff	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Users\Admin\Pictures\RestoreExit.tiff	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\RestoreExit.tiff => C:\Users\Admin\Pictures\RestoreExit.tiff.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\MeasureGrant.raw => C:\Users\Admin\Pictures\MeasureGrant.raw.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\GetAssert.tif => C:\Users\Admin\Pictures\GetAssert.tif.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\ConfirmRead.tiff => C:\Users\Admin\Pictures\ConfirmRead.tiff.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File renamed	C:\Users\Admin\Pictures\UnregisterComplete.tiff => C:\Users\Admin\Pictures\UnregisterComplete.tiff.avos2	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

description ioc process

File opened (read-only) \??\Z: 794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

description	ioc	process
File opened (read-only)	\??\Z:	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

Drops file in Program Files directory 64 IoCs

Processes:

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OSPP.HTM	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\settings.js	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\WMPDMC.exe.mui	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR6F.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Maroon.css	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\GET_YOUR_FILES_BACK.txt	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\GET_YOUR_FILES_BACK.txt	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveMergeLetter.dotx	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Events.accdt	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\REPTWIZ.POC	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL097.XML	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0090070.WMF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME17.CSS	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR16F.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14711_.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\GET_YOUR_FILES_BACK.txt	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_COL.HXC	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR29F.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGAD.DPV	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21503_.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212661.WMF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR11.POC	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29F.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15272_.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\GET_YOUR_FILES_BACK.txt	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_off.gif	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GRINTL32.DLL.IDX_DLL	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0214098.WAV	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_disable.gif	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\POLICIES.FDT	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\ODBCR.SAM	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00164_.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AWARDHM.POC	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PROGRAM.XML	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WCOMP98.POC	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLNOTER.FAE	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01039_.WMF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00297_.WMF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\GET_YOUR_FILES_BACK.txt	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\ja-JP\WinMail.exe.mui	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\GET_YOUR_FILES_BACK.txt	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\gadget.xml	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45F.GIF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18187_.WMF	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2444 vssadmin.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2760 NOTEPAD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exepowershell.exe

pid process

1760 794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
2904 powershell.exe

pid	process
2444	vssadmin.exe

pid	process
2760	NOTEPAD.EXE

pid	process
1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
2904	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exeWMIC.exepowershell.exevssvc.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
Token: SeIncreaseQuotaPrivilege	2896	WMIC.exe
Token: SeSecurityPrivilege	2896	WMIC.exe
Token: SeTakeOwnershipPrivilege	2896	WMIC.exe
Token: SeLoadDriverPrivilege	2896	WMIC.exe
Token: SeSystemProfilePrivilege	2896	WMIC.exe
Token: SeSystemtimePrivilege	2896	WMIC.exe
Token: SeProfSingleProcessPrivilege	2896	WMIC.exe
Token: SeIncBasePriorityPrivilege	2896	WMIC.exe
Token: SeCreatePagefilePrivilege	2896	WMIC.exe
Token: SeBackupPrivilege	2896	WMIC.exe
Token: SeRestorePrivilege	2896	WMIC.exe
Token: SeShutdownPrivilege	2896	WMIC.exe
Token: SeDebugPrivilege	2896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2896	WMIC.exe
Token: SeRemoteShutdownPrivilege	2896	WMIC.exe
Token: SeUndockPrivilege	2896	WMIC.exe
Token: SeManageVolumePrivilege	2896	WMIC.exe
Token: 33	2896	WMIC.exe
Token: 34	2896	WMIC.exe
Token: 35	2896	WMIC.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeIncreaseQuotaPrivilege	2896	WMIC.exe
Token: SeSecurityPrivilege	2896	WMIC.exe
Token: SeTakeOwnershipPrivilege	2896	WMIC.exe
Token: SeLoadDriverPrivilege	2896	WMIC.exe
Token: SeSystemProfilePrivilege	2896	WMIC.exe
Token: SeSystemtimePrivilege	2896	WMIC.exe
Token: SeProfSingleProcessPrivilege	2896	WMIC.exe
Token: SeIncBasePriorityPrivilege	2896	WMIC.exe
Token: SeCreatePagefilePrivilege	2896	WMIC.exe
Token: SeBackupPrivilege	2896	WMIC.exe
Token: SeRestorePrivilege	2896	WMIC.exe
Token: SeShutdownPrivilege	2896	WMIC.exe
Token: SeDebugPrivilege	2896	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2896	WMIC.exe
Token: SeRemoteShutdownPrivilege	2896	WMIC.exe
Token: SeUndockPrivilege	2896	WMIC.exe
Token: SeManageVolumePrivilege	2896	WMIC.exe
Token: 33	2896	WMIC.exe
Token: 34	2896	WMIC.exe
Token: 35	2896	WMIC.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2708	vssvc.exe
Token: SeRestorePrivilege	2708	vssvc.exe
Token: SeAuditPrivilege	2708	vssvc.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1760 wrote to memory of 852	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 852	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 852	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 852	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1060	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1060	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1060	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1060	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1780	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1780	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1780	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1780	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1220	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1220	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1220	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1220	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1184	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1184	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1184	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1760 wrote to memory of 1184	1760	794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe	cmd.exe
PID 1060 wrote to memory of 2444	1060	cmd.exe	vssadmin.exe
PID 1060 wrote to memory of 2444	1060	cmd.exe	vssadmin.exe
PID 1060 wrote to memory of 2444	1060	cmd.exe	vssadmin.exe
PID 1220 wrote to memory of 2472	1220	cmd.exe	bcdedit.exe
PID 1220 wrote to memory of 2472	1220	cmd.exe	bcdedit.exe
PID 1220 wrote to memory of 2472	1220	cmd.exe	bcdedit.exe
PID 852 wrote to memory of 2896	852	cmd.exe	WMIC.exe
PID 852 wrote to memory of 2896	852	cmd.exe	WMIC.exe
PID 852 wrote to memory of 2896	852	cmd.exe	WMIC.exe
PID 1184 wrote to memory of 2904	1184	cmd.exe	powershell.exe
PID 1184 wrote to memory of 2904	1184	cmd.exe	powershell.exe
PID 1184 wrote to memory of 2904	1184	cmd.exe	powershell.exe
PID 1780 wrote to memory of 2888	1780	cmd.exe	bcdedit.exe
PID 1780 wrote to memory of 2888	1780	cmd.exe	bcdedit.exe
PID 1780 wrote to memory of 2888	1780	cmd.exe	bcdedit.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe
"C:\Users\Admin\AppData\Local\Temp\794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\Windows\system32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:2444
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2888
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2472
- C:\Windows\system32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GET_YOUR_FILES_BACK.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
9bcb42cd18f95356b2d1a1a4de0b5aad

SHA1
b03da5cab852e8fafc12a52e424ec4b10431270d

SHA256
6e66527651da97c609c697e763e165eaf0fa1da104c26d311ec48fec9950ae24

SHA512
85961b90024f25a20943f9ce3b3c0959ced373d7b548cfc533bb51164aa615125528352438ab43e4b285ab570268bb4ed46f861db89d29d830230b9f63b0f496

Download Submit
C:\Users\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
9bcb42cd18f95356b2d1a1a4de0b5aad

SHA1
b03da5cab852e8fafc12a52e424ec4b10431270d

SHA256
6e66527651da97c609c697e763e165eaf0fa1da104c26d311ec48fec9950ae24

SHA512
85961b90024f25a20943f9ce3b3c0959ced373d7b548cfc533bb51164aa615125528352438ab43e4b285ab570268bb4ed46f861db89d29d830230b9f63b0f496

Download Submit
memory/2904-929-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2904-930-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2904-986-0x000000001B190000-0x000000001B472000-memory.dmp

Filesize
2.9MB

Download
memory/2904-1035-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2904-1405-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2904-1406-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads