avoslocker | 05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b

General

Target

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
Size

1002KB
MD5

7152fd25b0f11276a5bc19f2ccce5e75
SHA1

cba080861ab44809569f743a5aef581c0867938e
SHA256

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b
SHA512

503f0343838c062896ac5d27abfa681ac3e54db05dce691b23327d2f249430a992bb5eba85692fe41b3c09ce65df3ed089d3bd281f41a541bc798a8f10ca7016
SSDEEP

24576:G0XiZc8dyQNFphp8YPeM8LNKW3jGY+zSvxJcYq:7+NTXGM8LNF3jDQSoYq

Score

10^/10

avoslocker defense_evasion evasion execution impact ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

36704 bcdedit.exe
47884 bcdedit.exe
Renames multiple (8485) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

pid	process
36704	bcdedit.exe
47884	bcdedit.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe

description ioc process

File opened (read-only) \??\Z: 05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe

description	ioc	process
File opened (read-only)	\??\Z:	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\723567752.png"	reg.exe

Drops file in Program Files directory 64 IoCs

Processes:

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_f_col.hxk	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\PREVIEW.GIF	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\beta.identity_helper.exe.manifest	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado26.tlb	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ca-es\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-gb\ui-strings.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-125.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\es-419.pak.DATA	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\illustrations.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nb-no\ui-strings.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32_altform-unplated.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fi-fi\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\cs-cz\ui-strings.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\TIME.XML	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-200.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-400.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugin.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-200.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-100.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ul-oob.xrm-ms	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\ui-strings.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\PREVIEW.GIF	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\PackageManagementDscUtilities.strings.psd1	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ar_get.svg	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-150.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\PLANNERS.ONE	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ui-strings.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-125.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-150.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\download-btn.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-150.png	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\it.pak	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ca-es\ui-strings.js	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\uk-ua\GET_YOUR_FILES_BACK.txt	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

22440 powershell.exe
22068 powershell.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

36716 vssadmin.exe

pid	process
22440	powershell.exe
22068	powershell.exe

pid	process
36716	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exepowershell.exepowershell.exe

pid	process
2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
22440	powershell.exe
22440	powershell.exe
22440	powershell.exe
22068	powershell.exe
22068	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exeWMIC.exevssvc.exepowershell.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
Token: SeIncreaseQuotaPrivilege	22424	WMIC.exe
Token: SeSecurityPrivilege	22424	WMIC.exe
Token: SeTakeOwnershipPrivilege	22424	WMIC.exe
Token: SeLoadDriverPrivilege	22424	WMIC.exe
Token: SeSystemProfilePrivilege	22424	WMIC.exe
Token: SeSystemtimePrivilege	22424	WMIC.exe
Token: SeProfSingleProcessPrivilege	22424	WMIC.exe
Token: SeIncBasePriorityPrivilege	22424	WMIC.exe
Token: SeCreatePagefilePrivilege	22424	WMIC.exe
Token: SeBackupPrivilege	22424	WMIC.exe
Token: SeRestorePrivilege	22424	WMIC.exe
Token: SeShutdownPrivilege	22424	WMIC.exe
Token: SeDebugPrivilege	22424	WMIC.exe
Token: SeSystemEnvironmentPrivilege	22424	WMIC.exe
Token: SeRemoteShutdownPrivilege	22424	WMIC.exe
Token: SeUndockPrivilege	22424	WMIC.exe
Token: SeManageVolumePrivilege	22424	WMIC.exe
Token: 33	22424	WMIC.exe
Token: 34	22424	WMIC.exe
Token: 35	22424	WMIC.exe
Token: 36	22424	WMIC.exe
Token: SeIncreaseQuotaPrivilege	22424	WMIC.exe
Token: SeSecurityPrivilege	22424	WMIC.exe
Token: SeTakeOwnershipPrivilege	22424	WMIC.exe
Token: SeLoadDriverPrivilege	22424	WMIC.exe
Token: SeSystemProfilePrivilege	22424	WMIC.exe
Token: SeSystemtimePrivilege	22424	WMIC.exe
Token: SeProfSingleProcessPrivilege	22424	WMIC.exe
Token: SeIncBasePriorityPrivilege	22424	WMIC.exe
Token: SeCreatePagefilePrivilege	22424	WMIC.exe
Token: SeBackupPrivilege	22424	WMIC.exe
Token: SeRestorePrivilege	22424	WMIC.exe
Token: SeShutdownPrivilege	22424	WMIC.exe
Token: SeDebugPrivilege	22424	WMIC.exe
Token: SeSystemEnvironmentPrivilege	22424	WMIC.exe
Token: SeRemoteShutdownPrivilege	22424	WMIC.exe
Token: SeUndockPrivilege	22424	WMIC.exe
Token: SeManageVolumePrivilege	22424	WMIC.exe
Token: 33	22424	WMIC.exe
Token: 34	22424	WMIC.exe
Token: 35	22424	WMIC.exe
Token: 36	22424	WMIC.exe
Token: SeBackupPrivilege	36656	vssvc.exe
Token: SeRestorePrivilege	36656	vssvc.exe
Token: SeAuditPrivilege	36656	vssvc.exe
Token: SeDebugPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeSecurityPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeSecurityPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe
Token: SeSecurityPrivilege	22440	powershell.exe
Token: SeBackupPrivilege	22440	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.execmd.execmd.execmd.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 2640 wrote to memory of 2564	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 2564	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 3092	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 3092	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 3664	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 3664	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 3472	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 3472	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 2988	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 2640 wrote to memory of 2988	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	cmd.exe
PID 3664 wrote to memory of 36704	3664	cmd.exe	bcdedit.exe
PID 3664 wrote to memory of 36704	3664	cmd.exe	bcdedit.exe
PID 3092 wrote to memory of 36716	3092	cmd.exe	vssadmin.exe
PID 3092 wrote to memory of 36716	3092	cmd.exe	vssadmin.exe
PID 3472 wrote to memory of 47884	3472	cmd.exe	bcdedit.exe
PID 3472 wrote to memory of 47884	3472	cmd.exe	bcdedit.exe
PID 2564 wrote to memory of 22424	2564	cmd.exe	WMIC.exe
PID 2564 wrote to memory of 22424	2564	cmd.exe	WMIC.exe
PID 2988 wrote to memory of 22440	2988	cmd.exe	powershell.exe
PID 2988 wrote to memory of 22440	2988	cmd.exe	powershell.exe
PID 2640 wrote to memory of 22068	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	powershell.exe
PID 2640 wrote to memory of 22068	2640	05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe	powershell.exe
PID 22068 wrote to memory of 22444	22068	powershell.exe	reg.exe
PID 22068 wrote to memory of 22444	22068	powershell.exe	reg.exe
PID 22068 wrote to memory of 22668	22068	powershell.exe	rundll32.exe
PID 22068 wrote to memory of 22668	22068	powershell.exe	rundll32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe
"C:\Users\Admin\AppData\Local\Temp\05a53b88ceab3708ce07d5c879978265a090975c5ff063b7bea3b045c99b134b.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:22424
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:36716
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:36704
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:47884
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:22440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:22068
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\723567752.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:22444
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:22668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:36656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Windows Management Instrumentation

1

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

2

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

3

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
eb6332ae9e8fec69c2236355e2638f9d

SHA1
71500d57fb304979afd6756f06d4b9a59f995eb7

SHA256
88e5ffe18fd4a772efce68f1b0db839846cafc42d36415508ad5356a44d38f32

SHA512
e87c864ba79bd7a10a62b55ad564cf3acb090e7d85707a6967497deeef5fcde1f0b4608ea8791bf81363ec583a0101d470d8f3cd2172ced8d4071d7f6c674aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e3ge4xha.rur.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
F:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
01188d22b1675e3437b1418e14f4ffab

SHA1
6e7127f3bbfce49485ed8f1acf8f697bcb952818

SHA256
e4b3ac00a0b2eb195b26abffbc4368077384e73393e51605edda17dae05ab7f2

SHA512
6903ae3247f32ad79c60a2062cd6a7bdbf5a7c9db1bdc43bdbef4da3396945014d30968ea4c8531a2d0c7b695f1ea36e2b8c51bb39cc6157c4096ac04a6e187d

Download Submit
memory/2640-5-0x0000000002270000-0x00000000022B3000-memory.dmp

Filesize
268KB

Download
memory/2640-4-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2640-7-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2640-8-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2640-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2640-6-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/2640-2-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2640-22683-0x0000000002270000-0x00000000022B3000-memory.dmp

Filesize
268KB

Download
memory/2640-22682-0x0000000000401000-0x000000000049D000-memory.dmp

Filesize
624KB

Download
memory/2640-22681-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2640-3-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2640-1-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/22440-17400-0x0000018D7FCE0000-0x0000018D7FD02000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads