avoslocker | fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb

Analysis

max time kernel
125s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
Size

1002KB
MD5

29a6c44066af8bc35809cd1f8976b4d1
SHA1

b963ab9dadb49efe06b1ddddc1bee6e617d8f3e2
SHA256

fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb
SHA512

33e8027a78612ffe88e99b5281f4c2506727c1829dca4f7168d3dd915adf9e4985ded41f4f68cbc05f599d82e1ff44d0a2ba917bb0ed3873acd047bb96dc9627
SSDEEP

24576:UgoMwIykL7QZON73jGEItU5D7aaBWiP/3VUl:wMTfQUFTTItU5DeWP/3VUl

Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
38064	bcdedit.exe
38988	bcdedit.exe

Renames multiple (8453) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2076628678.png"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\sl-si\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fi-fi\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\pmd.cer	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-125.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\it-IT\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\editvideoimage.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluEmptyStateCCFiles_280x192.svg	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-64.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLSTART\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\identity_helper.Sparse.Canary.msix	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\css\main-selector.css	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\SoftLandingAssetLight.gif	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nl-nl\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-400.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\close.svg	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\OriginResume.Dotx	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sr.pak	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\dd_arrow_small.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCacheMini.scale-125.png	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Canary.msix.DATA	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\comdll.X.manifest	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\ui-strings.js	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File created	C:\Program Files (x86)\Common Files\System\ja-JP\GET_YOUR_FILES_BACK.txt	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageProviderFunctions.psm1	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
39004	powershell.exe
34628	powershell.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
38996	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
39004	powershell.exe
39004	powershell.exe
39004	powershell.exe
34628	powershell.exe
34628	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
Token: SeIncreaseQuotaPrivilege	38948	WMIC.exe
Token: SeSecurityPrivilege	38948	WMIC.exe
Token: SeTakeOwnershipPrivilege	38948	WMIC.exe
Token: SeLoadDriverPrivilege	38948	WMIC.exe
Token: SeSystemProfilePrivilege	38948	WMIC.exe
Token: SeSystemtimePrivilege	38948	WMIC.exe
Token: SeProfSingleProcessPrivilege	38948	WMIC.exe
Token: SeIncBasePriorityPrivilege	38948	WMIC.exe
Token: SeCreatePagefilePrivilege	38948	WMIC.exe
Token: SeBackupPrivilege	38948	WMIC.exe
Token: SeRestorePrivilege	38948	WMIC.exe
Token: SeShutdownPrivilege	38948	WMIC.exe
Token: SeDebugPrivilege	38948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	38948	WMIC.exe
Token: SeRemoteShutdownPrivilege	38948	WMIC.exe
Token: SeUndockPrivilege	38948	WMIC.exe
Token: SeManageVolumePrivilege	38948	WMIC.exe
Token: 33	38948	WMIC.exe
Token: 34	38948	WMIC.exe
Token: 35	38948	WMIC.exe
Token: 36	38948	WMIC.exe
Token: SeDebugPrivilege	39004	powershell.exe
Token: SeIncreaseQuotaPrivilege	38948	WMIC.exe
Token: SeSecurityPrivilege	38948	WMIC.exe
Token: SeTakeOwnershipPrivilege	38948	WMIC.exe
Token: SeLoadDriverPrivilege	38948	WMIC.exe
Token: SeSystemProfilePrivilege	38948	WMIC.exe
Token: SeSystemtimePrivilege	38948	WMIC.exe
Token: SeProfSingleProcessPrivilege	38948	WMIC.exe
Token: SeIncBasePriorityPrivilege	38948	WMIC.exe
Token: SeCreatePagefilePrivilege	38948	WMIC.exe
Token: SeBackupPrivilege	38948	WMIC.exe
Token: SeRestorePrivilege	38948	WMIC.exe
Token: SeShutdownPrivilege	38948	WMIC.exe
Token: SeDebugPrivilege	38948	WMIC.exe
Token: SeSystemEnvironmentPrivilege	38948	WMIC.exe
Token: SeRemoteShutdownPrivilege	38948	WMIC.exe
Token: SeUndockPrivilege	38948	WMIC.exe
Token: SeManageVolumePrivilege	38948	WMIC.exe
Token: 33	38948	WMIC.exe
Token: 34	38948	WMIC.exe
Token: 35	38948	WMIC.exe
Token: 36	38948	WMIC.exe
Token: SeBackupPrivilege	32428	vssvc.exe
Token: SeRestorePrivilege	32428	vssvc.exe
Token: SeAuditPrivilege	32428	vssvc.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeSecurityPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeSecurityPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe
Token: SeSecurityPrivilege	39004	powershell.exe
Token: SeBackupPrivilege	39004	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1420	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	84
PID 4544 wrote to memory of 1420	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	84
PID 4544 wrote to memory of 1900	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	85
PID 4544 wrote to memory of 1900	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	85
PID 4544 wrote to memory of 4364	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	86
PID 4544 wrote to memory of 4364	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	86
PID 4544 wrote to memory of 4888	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	87
PID 4544 wrote to memory of 4888	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	87
PID 4544 wrote to memory of 4224	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	88
PID 4544 wrote to memory of 4224	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	88
PID 1420 wrote to memory of 38948	1420	cmd.exe	89
PID 1420 wrote to memory of 38948	1420	cmd.exe	89
PID 1900 wrote to memory of 38996	1900	cmd.exe	91
PID 1900 wrote to memory of 38996	1900	cmd.exe	91
PID 4364 wrote to memory of 38988	4364	cmd.exe	90
PID 4364 wrote to memory of 38988	4364	cmd.exe	90
PID 4224 wrote to memory of 39004	4224	cmd.exe	92
PID 4224 wrote to memory of 39004	4224	cmd.exe	92
PID 4888 wrote to memory of 38064	4888	cmd.exe	93
PID 4888 wrote to memory of 38064	4888	cmd.exe	93
PID 4544 wrote to memory of 34628	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	98
PID 4544 wrote to memory of 34628	4544	fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe	98
PID 34628 wrote to memory of 35832	34628	powershell.exe	99
PID 34628 wrote to memory of 35832	34628	powershell.exe	99
PID 34628 wrote to memory of 37004	34628	powershell.exe	103
PID 34628 wrote to memory of 37004	34628	powershell.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe
"C:\Users\Admin\AppData\Local\Temp\fd0c1a35cc4ac399e015dab9a976dc3ed835d64cd96e1730f110249a74fd67bb.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:38948
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:38996
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:38988
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:38064
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:39004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:34628
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2076628678.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:35832
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:37004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:32428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
6d81ed40ba0a283e5483bfe6a448e9d7

SHA1
0c847a5f9df743b13e1aa11b4c24a4309e9a7119

SHA256
b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d

SHA512
8956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
7274a07d1b80de6f66290b47588cee3b

SHA1
d926b384806c755fe6b9d03f68852765aabb5703

SHA256
5eba7517357473e4d5d7ede75c3768069c578d2b0023473fd67f76b373430de8

SHA512
b7813fea9091298d48c87b259b0d4473ddc4480667f82ed6b5f8bdfa600590dcbfb1d62cbaca649dcf321d85cb786bf62d48826ab04297a22b7c88439b94bcf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eg3qdsht.xfj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4544-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-22613-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-7-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/4544-6-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-5-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/4544-2-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-1-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-4-0x00000000007A0000-0x00000000007E3000-memory.dmp

Filesize
268KB

Download
memory/4544-21755-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-9-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/4544-22615-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/4544-22614-0x00000000007A0000-0x00000000007E3000-memory.dmp

Filesize
268KB

Download
memory/4544-3-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/39004-17300-0x0000017534F20000-0x0000017534F42000-memory.dmp

Filesize
136KB

Download