avoslocker | 00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
Size

1002KB
MD5

6eb93471d34dce78877ebc870816238f
SHA1

288796474024860cd052925518947e71da404aeb
SHA256

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f
SHA512

1e7e6dcddd3d799e1180a2e0edb37f61b170ffb2d6ccc32fc13057c0ce39aa379217c46749c390f63af727e5041a374b612753babdbdb8aaf893e51118ec3ea6
SSDEEP

24576:eUBPDxG9OhoBEbxWx7wS1XKNPe3U+Emr:eU5NQqWxtKl6wg

Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exe

pid	Process
4024	bcdedit.exe
1172	bcdedit.exe

Renames multiple (8462) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 1 IoCs

Processes:

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

description	ioc	Process
File opened (read-only)	\??\Z:	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6581503.png"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-100.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\eu-es\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fi-fi\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20_altform-unplated.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\vlc.mo	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\Common Files\System\ado\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-125.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.json	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ms_get.svg	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pt-br\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-150.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.strings.psd1	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\wmpnssci.dll.mui	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxMediumTile.scale-100.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Windows Media Player\Icons\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ja-JP\PhotoAcq.dll.mui	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\manifest.xml	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Canary.msix.DATA	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-ae\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-16_altform-unplated.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-60.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-300.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\jvm.lib	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\zh-cn\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-150.png	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\GET_YOUR_FILES_BACK.txt	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\zh-cn\ui-strings.js	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
5116	powershell.exe
35880	powershell.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Processes:

vssadmin.exe

pid	Process
4348	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exepowershell.exepowershell.exe

pid	Process
2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
5116	powershell.exe
5116	powershell.exe
5116	powershell.exe
35880	powershell.exe
35880	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exeWMIC.exevssvc.exepowershell.exe

description	pid	Process
Token: SeTakeOwnershipPrivilege	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe
Token: 36	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemProfilePrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeProfSingleProcessPrivilege	1200	WMIC.exe
Token: SeIncBasePriorityPrivilege	1200	WMIC.exe
Token: SeCreatePagefilePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeDebugPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeRemoteShutdownPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: 33	1200	WMIC.exe
Token: 34	1200	WMIC.exe
Token: 35	1200	WMIC.exe
Token: 36	1200	WMIC.exe
Token: SeBackupPrivilege	34972	vssvc.exe
Token: SeRestorePrivilege	34972	vssvc.exe
Token: SeAuditPrivilege	34972	vssvc.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeSecurityPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeSecurityPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe
Token: SeSecurityPrivilege	5116	powershell.exe
Token: SeBackupPrivilege	5116	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.execmd.execmd.execmd.execmd.execmd.exepowershell.exe

description	pid	Process	procid_target
PID 2008 wrote to memory of 2952	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	82
PID 2008 wrote to memory of 2952	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	82
PID 2008 wrote to memory of 4788	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	83
PID 2008 wrote to memory of 4788	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	83
PID 2008 wrote to memory of 4764	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	84
PID 2008 wrote to memory of 4764	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	84
PID 2008 wrote to memory of 3468	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	85
PID 2008 wrote to memory of 3468	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	85
PID 2008 wrote to memory of 4468	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	86
PID 2008 wrote to memory of 4468	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	86
PID 2952 wrote to memory of 1200	2952	cmd.exe	89
PID 2952 wrote to memory of 1200	2952	cmd.exe	89
PID 4788 wrote to memory of 4348	4788	cmd.exe	90
PID 4788 wrote to memory of 4348	4788	cmd.exe	90
PID 3468 wrote to memory of 1172	3468	cmd.exe	91
PID 3468 wrote to memory of 1172	3468	cmd.exe	91
PID 4468 wrote to memory of 5116	4468	cmd.exe	93
PID 4468 wrote to memory of 5116	4468	cmd.exe	93
PID 4764 wrote to memory of 4024	4764	cmd.exe	92
PID 4764 wrote to memory of 4024	4764	cmd.exe	92
PID 2008 wrote to memory of 35880	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	96
PID 2008 wrote to memory of 35880	2008	00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe	96
PID 35880 wrote to memory of 36176	35880	powershell.exe	97
PID 35880 wrote to memory of 36176	35880	powershell.exe	97
PID 35880 wrote to memory of 36604	35880	powershell.exe	101
PID 35880 wrote to memory of 36604	35880	powershell.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe
"C:\Users\Admin\AppData\Local\Temp\00688ead526d7ae741450c176a3c9a0a24f4da5980c6c7c09b6088fbee205d7f.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4348
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4024
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1172
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:35880
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6581503.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:36176
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:36604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:34972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
b69a0aa7abf916a5f00d0f438cf98fa6

SHA1
1ad8aec6b066487d69492225bb6493b4afd2db64

SHA256
9a3b665f5458ade3c61be4fd2f906a915f8c523127be7456a6bff3677356289d

SHA512
cec0c8f59d7c204f33452223b0f9eaa55bc0ef07f983c42fbdd3ff0906814bf907816bd6b4dd2dbb3292f6396f22b50b0736caf469f1a942fdd7cd09c099cd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
a6c9d692ed2826ecb12c09356e69cc09

SHA1
def728a6138cf083d8a7c61337f3c9dade41a37f

SHA256
a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

SHA512
2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ua50kyu.uww.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2008-1-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2008-9-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2008-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2008-6-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/2008-5-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/2008-2-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2008-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2008-4-0x0000000002270000-0x00000000022B3000-memory.dmp

Filesize
268KB

Download
memory/2008-22634-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/2008-22635-0x0000000002270000-0x00000000022B3000-memory.dmp

Filesize
268KB

Download
memory/2008-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2008-22633-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2008-3-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/5116-17433-0x000001A2D44B0000-0x000001A2D44D2000-memory.dmp

Filesize
136KB

Download