avoslocker | 06918af465e607aa81a46042c24e6a8c45d7c983f33ee621caad6b25464dd27a

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

1.1MB
MD5

bc78307b49282fd1039a09c88f5e57d9
SHA1

56ca25bc143ec38871fa5e96561437755a9d0de9
SHA256

06918af465e607aa81a46042c24e6a8c45d7c983f33ee621caad6b25464dd27a
SHA512

af4d43f05b3583d07fb96e0815bcc5624e7e3eb110981a21ff82ec07829bcdfd3d23c7de1b673a41bfb41ac20614f27a28389aed80f75a4399c52b351ba5b5f5
SSDEEP

24576:u4s+oT+NXBLi0rjFXvyHBlbmCZa8Ch1972J1+i3DO2gik:uioT+NXVFjxvMBlbmya8CF4TO2K

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Avoslocker family
avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1812	bcdedit.exe
4060	bcdedit.exe

Renames multiple (10388) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	test.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	test.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\606245847.png"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png	test.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18193_.WMF	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301432.WMF	test.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js	test.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Colombo	test.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Windows Media Player\it-IT\wmpnscfg.exe.mui	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\UserControl.zip	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183290.WMF	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01172_.WMF	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji	test.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR11F.GIF	test.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund	test.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieMergeLetter.dotx	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\utilityfunctions.js	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0086384.WMF	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02293_.WMF	test.exe
File opened for modification	C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPQUOT.DPV	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03795_.WMF	test.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png	test.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_left.png	test.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar	test.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi	test.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\DADSHIRT.GIF	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR25F.GIF	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\+NewSQLServerConnection.odc	test.exe
File created	C:\Program Files (x86)\Adobe\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185842.WMF	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00232_.WMF	test.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar	test.exe
File created	C:\Program Files\DVD Maker\es-ES\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\settings.css	test.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SAFRI_01.MID	test.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\PREVIEW.GIF	test.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\form_edit.js	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHSRN.DAT	test.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png	test.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet	test.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00092_.WMF	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187849.WMF	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF	test.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.properties	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt	test.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18250_.WMF	test.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\GET_YOUR_FILES_BACK.txt	test.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	test.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3268	powershell.exe
5116	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4052	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2260	test.exe
3268	powershell.exe
5116	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2260	test.exe
Token: SeIncreaseQuotaPrivilege	3164	WMIC.exe
Token: SeSecurityPrivilege	3164	WMIC.exe
Token: SeTakeOwnershipPrivilege	3164	WMIC.exe
Token: SeLoadDriverPrivilege	3164	WMIC.exe
Token: SeSystemProfilePrivilege	3164	WMIC.exe
Token: SeSystemtimePrivilege	3164	WMIC.exe
Token: SeProfSingleProcessPrivilege	3164	WMIC.exe
Token: SeIncBasePriorityPrivilege	3164	WMIC.exe
Token: SeCreatePagefilePrivilege	3164	WMIC.exe
Token: SeBackupPrivilege	3164	WMIC.exe
Token: SeRestorePrivilege	3164	WMIC.exe
Token: SeShutdownPrivilege	3164	WMIC.exe
Token: SeDebugPrivilege	3164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3164	WMIC.exe
Token: SeRemoteShutdownPrivilege	3164	WMIC.exe
Token: SeUndockPrivilege	3164	WMIC.exe
Token: SeManageVolumePrivilege	3164	WMIC.exe
Token: 33	3164	WMIC.exe
Token: 34	3164	WMIC.exe
Token: 35	3164	WMIC.exe
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeIncreaseQuotaPrivilege	3164	WMIC.exe
Token: SeSecurityPrivilege	3164	WMIC.exe
Token: SeTakeOwnershipPrivilege	3164	WMIC.exe
Token: SeLoadDriverPrivilege	3164	WMIC.exe
Token: SeSystemProfilePrivilege	3164	WMIC.exe
Token: SeSystemtimePrivilege	3164	WMIC.exe
Token: SeProfSingleProcessPrivilege	3164	WMIC.exe
Token: SeIncBasePriorityPrivilege	3164	WMIC.exe
Token: SeCreatePagefilePrivilege	3164	WMIC.exe
Token: SeBackupPrivilege	3164	WMIC.exe
Token: SeRestorePrivilege	3164	WMIC.exe
Token: SeShutdownPrivilege	3164	WMIC.exe
Token: SeDebugPrivilege	3164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3164	WMIC.exe
Token: SeRemoteShutdownPrivilege	3164	WMIC.exe
Token: SeUndockPrivilege	3164	WMIC.exe
Token: SeManageVolumePrivilege	3164	WMIC.exe
Token: 33	3164	WMIC.exe
Token: 34	3164	WMIC.exe
Token: 35	3164	WMIC.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeBackupPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe
Token: SeSecurityPrivilege	3268	powershell.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2160	2260	test.exe	31
PID 2260 wrote to memory of 2160	2260	test.exe	31
PID 2260 wrote to memory of 2160	2260	test.exe	31
PID 2260 wrote to memory of 2160	2260	test.exe	31
PID 2260 wrote to memory of 2716	2260	test.exe	32
PID 2260 wrote to memory of 2716	2260	test.exe	32
PID 2260 wrote to memory of 2716	2260	test.exe	32
PID 2260 wrote to memory of 2716	2260	test.exe	32
PID 2260 wrote to memory of 2720	2260	test.exe	33
PID 2260 wrote to memory of 2720	2260	test.exe	33
PID 2260 wrote to memory of 2720	2260	test.exe	33
PID 2260 wrote to memory of 2720	2260	test.exe	33
PID 2260 wrote to memory of 2848	2260	test.exe	34
PID 2260 wrote to memory of 2848	2260	test.exe	34
PID 2260 wrote to memory of 2848	2260	test.exe	34
PID 2260 wrote to memory of 2848	2260	test.exe	34
PID 2260 wrote to memory of 2864	2260	test.exe	35
PID 2260 wrote to memory of 2864	2260	test.exe	35
PID 2260 wrote to memory of 2864	2260	test.exe	35
PID 2260 wrote to memory of 2864	2260	test.exe	35
PID 2720 wrote to memory of 1812	2720	cmd.exe	36
PID 2720 wrote to memory of 1812	2720	cmd.exe	36
PID 2720 wrote to memory of 1812	2720	cmd.exe	36
PID 2160 wrote to memory of 3164	2160	cmd.exe	37
PID 2160 wrote to memory of 3164	2160	cmd.exe	37
PID 2160 wrote to memory of 3164	2160	cmd.exe	37
PID 2864 wrote to memory of 3268	2864	cmd.exe	38
PID 2864 wrote to memory of 3268	2864	cmd.exe	38
PID 2864 wrote to memory of 3268	2864	cmd.exe	38
PID 2716 wrote to memory of 4052	2716	cmd.exe	39
PID 2716 wrote to memory of 4052	2716	cmd.exe	39
PID 2716 wrote to memory of 4052	2716	cmd.exe	39
PID 2848 wrote to memory of 4060	2848	cmd.exe	40
PID 2848 wrote to memory of 4060	2848	cmd.exe	40
PID 2848 wrote to memory of 4060	2848	cmd.exe	40
PID 2260 wrote to memory of 5116	2260	test.exe	45
PID 2260 wrote to memory of 5116	2260	test.exe	45
PID 2260 wrote to memory of 5116	2260	test.exe	45
PID 2260 wrote to memory of 5116	2260	test.exe	45
PID 5116 wrote to memory of 5260	5116	powershell.exe	46
PID 5116 wrote to memory of 5260	5116	powershell.exe	46
PID 5116 wrote to memory of 5260	5116	powershell.exe	46
PID 5116 wrote to memory of 3148	5116	powershell.exe	47
PID 5116 wrote to memory of 3148	5116	powershell.exe	47
PID 5116 wrote to memory of 3148	5116	powershell.exe	47

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- C:\Windows\system32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4052
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1812
- C:\Windows\system32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4060
- C:\Windows\system32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"F:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\606245847.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:5260
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:3148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
28386412dbbeaf03f5a2c507fcf290c5

SHA1
80191d5538f52a68d2b9fbf2686161590c143697

SHA256
6ed8f89589b03d1551aa779c9ba683c56897ff5d46644a369f5a48bd93958e67

SHA512
dcb6c4218a4ff7a8291e3ce204c1e19ffd6b32f23c37fc685e3c60e1083e37ee62335d45e2b915b81b97417d6bc41258398efbd96f0901bbea71afb435624745

Download Submit
F:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
c92c2b70fb37f84aab38412ad9226aa8

SHA1
14f2e9a83285612d0a7b2c83b8f89bccfde6c154

SHA256
d64639e873c0873b469cd856d1ef4bce7dc14a80fac6fe2bed9d629f05acc77f

SHA512
04f9dcb3cd49909712535255b6eadd7fafcb2902bf1abd5a25e9bb5f5c4dc032611aec0a5b0ec89cd7dbc65276b935c54b906b391507d2e3e3aa65466b15f848

Download Submit
memory/3268-1703-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/3268-1735-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/5116-24522-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download
memory/5116-24523-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download