avoslocker | 00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
Size

1002KB
MD5

6eb93471d34dce78877ebc870816238f
SHA1

288796474024860cd052925518947e71da404aeb
SHA256

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f
SHA512

1e7e6dcddd3d799e1180a2e0edb37f61b170ffb2d6ccc32fc13057c0ce39aa379217c46749c390f63af727e5041a374b612753babdbdb8aaf893e51118ec3ea6
SSDEEP

24576:eUBPDxG9OhoBEbxWx7wS1XKNPe3U+Emr:eU5NQqWxtKl6wg

Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1044	bcdedit.exe
4736	bcdedit.exe

Renames multiple (10383) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2090100087.png"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_OFF.GIF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_K_COL.HXK	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00037_.GIF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19695_.WMF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212685.WMF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\Internet Explorer\it-IT\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00494_.WMF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGREPFRM.DPV	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\HEADING.JPG	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR22F.GIF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis.css	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400005.PNG	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\.eclipseproduct	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\ShadesOfBlue.jpg	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR17F.GIF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00010_.WMF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Common Files\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10267_.GIF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\settings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_K_COL.HXK	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215709.WMF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01236U.BMP	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.DPV	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL096.XML	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01162_.WMF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\cpu.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\settings.css	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\PLUS.GIF	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe
4492	powershell.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1324	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
4276	powershell.exe
4492	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
Token: SeIncreaseQuotaPrivilege	4080	WMIC.exe
Token: SeSecurityPrivilege	4080	WMIC.exe
Token: SeTakeOwnershipPrivilege	4080	WMIC.exe
Token: SeLoadDriverPrivilege	4080	WMIC.exe
Token: SeSystemProfilePrivilege	4080	WMIC.exe
Token: SeSystemtimePrivilege	4080	WMIC.exe
Token: SeProfSingleProcessPrivilege	4080	WMIC.exe
Token: SeIncBasePriorityPrivilege	4080	WMIC.exe
Token: SeCreatePagefilePrivilege	4080	WMIC.exe
Token: SeBackupPrivilege	4080	WMIC.exe
Token: SeRestorePrivilege	4080	WMIC.exe
Token: SeShutdownPrivilege	4080	WMIC.exe
Token: SeDebugPrivilege	4080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4080	WMIC.exe
Token: SeRemoteShutdownPrivilege	4080	WMIC.exe
Token: SeUndockPrivilege	4080	WMIC.exe
Token: SeManageVolumePrivilege	4080	WMIC.exe
Token: 33	4080	WMIC.exe
Token: 34	4080	WMIC.exe
Token: 35	4080	WMIC.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeIncreaseQuotaPrivilege	4080	WMIC.exe
Token: SeSecurityPrivilege	4080	WMIC.exe
Token: SeTakeOwnershipPrivilege	4080	WMIC.exe
Token: SeLoadDriverPrivilege	4080	WMIC.exe
Token: SeSystemProfilePrivilege	4080	WMIC.exe
Token: SeSystemtimePrivilege	4080	WMIC.exe
Token: SeProfSingleProcessPrivilege	4080	WMIC.exe
Token: SeIncBasePriorityPrivilege	4080	WMIC.exe
Token: SeCreatePagefilePrivilege	4080	WMIC.exe
Token: SeBackupPrivilege	4080	WMIC.exe
Token: SeRestorePrivilege	4080	WMIC.exe
Token: SeShutdownPrivilege	4080	WMIC.exe
Token: SeDebugPrivilege	4080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4080	WMIC.exe
Token: SeRemoteShutdownPrivilege	4080	WMIC.exe
Token: SeUndockPrivilege	4080	WMIC.exe
Token: SeManageVolumePrivilege	4080	WMIC.exe
Token: 33	4080	WMIC.exe
Token: 34	4080	WMIC.exe
Token: 35	4080	WMIC.exe
Token: SeBackupPrivilege	4456	vssvc.exe
Token: SeRestorePrivilege	4456	vssvc.exe
Token: SeAuditPrivilege	4456	vssvc.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe
Token: SeBackupPrivilege	4276	powershell.exe
Token: SeSecurityPrivilege	4276	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1788	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	29
PID 2088 wrote to memory of 1788	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	29
PID 2088 wrote to memory of 1788	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	29
PID 2088 wrote to memory of 1788	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	29
PID 2088 wrote to memory of 1048	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	30
PID 2088 wrote to memory of 1048	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	30
PID 2088 wrote to memory of 1048	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	30
PID 2088 wrote to memory of 1048	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	30
PID 2088 wrote to memory of 1804	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	31
PID 2088 wrote to memory of 1804	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	31
PID 2088 wrote to memory of 1804	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	31
PID 2088 wrote to memory of 1804	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	31
PID 2088 wrote to memory of 1912	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	32
PID 2088 wrote to memory of 1912	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	32
PID 2088 wrote to memory of 1912	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	32
PID 2088 wrote to memory of 1912	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	32
PID 2088 wrote to memory of 1676	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	33
PID 2088 wrote to memory of 1676	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	33
PID 2088 wrote to memory of 1676	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	33
PID 2088 wrote to memory of 1676	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	33
PID 1048 wrote to memory of 1324	1048	cmd.exe	34
PID 1048 wrote to memory of 1324	1048	cmd.exe	34
PID 1048 wrote to memory of 1324	1048	cmd.exe	34
PID 1912 wrote to memory of 1044	1912	cmd.exe	35
PID 1912 wrote to memory of 1044	1912	cmd.exe	35
PID 1912 wrote to memory of 1044	1912	cmd.exe	35
PID 1788 wrote to memory of 4080	1788	cmd.exe	36
PID 1788 wrote to memory of 4080	1788	cmd.exe	36
PID 1788 wrote to memory of 4080	1788	cmd.exe	36
PID 1804 wrote to memory of 4736	1804	cmd.exe	37
PID 1804 wrote to memory of 4736	1804	cmd.exe	37
PID 1804 wrote to memory of 4736	1804	cmd.exe	37
PID 1676 wrote to memory of 4276	1676	cmd.exe	38
PID 1676 wrote to memory of 4276	1676	cmd.exe	38
PID 1676 wrote to memory of 4276	1676	cmd.exe	38
PID 2088 wrote to memory of 4492	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	43
PID 2088 wrote to memory of 4492	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	43
PID 2088 wrote to memory of 4492	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	43
PID 2088 wrote to memory of 4492	2088	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	43
PID 4492 wrote to memory of 1948	4492	powershell.exe	44
PID 4492 wrote to memory of 1948	4492	powershell.exe	44
PID 4492 wrote to memory of 1948	4492	powershell.exe	44
PID 4492 wrote to memory of 4200	4492	powershell.exe	45
PID 4492 wrote to memory of 4200	4492	powershell.exe	45
PID 4492 wrote to memory of 4200	4492	powershell.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
"C:\Users\Admin\AppData\Local\Temp\00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- C:\Windows\system32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1324
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4736
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1044
- C:\Windows\system32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"Z:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2090100087.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:1948
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:4200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2090100087.png

Filesize
32KB

MD5
22a90a703f3150597c9be76ffafa5136

SHA1
bff44186563afeccda1406b17401de052c2a3366

SHA256
eab4c9e752548c3a53887993ae66891861a376210ee363e49b4bb29d97d91b7d

SHA512
8bf44a4baa4b19961143e90ddbd02faa1ff321a8742e6ebefd776d7a09d4a8e4aca2b6a6157bba1905f51de54bcfba6ffdfbae71377a6be4bce65332b0b3fa33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f105965aec4e6b6aa30275c5167567b9

SHA1
d8fe2af6a47b1f576cae7c834a0e4b3f5a5544df

SHA256
8af8a9fc2772d9233f7162e1aef44cc6e7654667500cbc8c24c6e1eebf8c7a77

SHA512
a2c430e6c0513240929143406e7cd3eea05d9ef54f76b43af6112aaad5b2b413ac14e598f393ef89f62e8367f6932894d0fc87f5c9750f7f3fee8eed82103d98

Download Submit
\Device\HarddiskVolume1\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
b69a0aa7abf916a5f00d0f438cf98fa6

SHA1
1ad8aec6b066487d69492225bb6493b4afd2db64

SHA256
9a3b665f5458ade3c61be4fd2f906a915f8c523127be7456a6bff3677356289d

SHA512
cec0c8f59d7c204f33452223b0f9eaa55bc0ef07f983c42fbdd3ff0906814bf907816bd6b4dd2dbb3292f6396f22b50b0736caf469f1a942fdd7cd09c099cd72

Download Submit
memory/2088-8148-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-14635-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-2-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2088-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-4-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-1-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-5-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-14636-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-3-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-17367-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-18308-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-18376-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-20777-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-20816-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2088-24501-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4276-1303-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/4276-1258-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/4492-24508-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/4492-24509-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download