Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 13:50
Static task
static1
Behavioral task
behavioral1
Sample
testing.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
testing.exe
Resource
win10v2004-20241007-en
General
-
Target
testing.exe
-
Size
1.1MB
-
MD5
9bab6ed20e3975cec860894d96f1de7c
-
SHA1
b4647855c5f313fadc03347ea10272fda260dd22
-
SHA256
368041501211167866ce2f39dfd64e596707763d2c9e448565e28d92c649aa71
-
SHA512
14c5d8c19429aebfc5ed678d56de3b3d53e2272eda11567d85723933bbca600e00eeb52e5562278c67b08ac87b6c1bc45b6dc8b653a8d545d1edd8c8aa78432a
-
SSDEEP
24576:tImw98okVgela0as5CqLVO7XJCjkD3N0HRA:DL5ljasaU
Malware Config
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Avoslocker family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1984 bcdedit.exe 2016 bcdedit.exe -
Renames multiple (10383) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 2608 P1kAlMiG2Kb7.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI P1kAlMiG2Kb7.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: P1kAlMiG2Kb7.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1054300142.png" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\1033\STINTL.DLL.IDX_DLL P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Detroit P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49F.GIF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18229_.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107480.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Juan P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18255_.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Publisher.en-us\SETUP.XML P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107712.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml P1kAlMiG2Kb7.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN01060_.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01167_.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js P1kAlMiG2Kb7.exe File created C:\Program Files\Windows NT\TableTextService\es-ES\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\vlc.mo P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_K_COL.HXK P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00784_.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar P1kAlMiG2Kb7.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryMergeLetter.dotx P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIDBAR98.POC P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183174.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\settings.css P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp P1kAlMiG2Kb7.exe File created C:\Program Files\Internet Explorer\ja-JP\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187863.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03470_.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240719.WMF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN086.XML P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_left_over.gif P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ACCESS12.ACC P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01332U.BMP P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\SPRING.INF P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Mozilla Firefox\update-settings.ini P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar P1kAlMiG2Kb7.exe -
pid Process 4052 powershell.exe 1052 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language P1kAlMiG2Kb7.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2484 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2608 P1kAlMiG2Kb7.exe 4052 powershell.exe 1052 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2608 P1kAlMiG2Kb7.exe Token: SeIncreaseQuotaPrivilege 2564 WMIC.exe Token: SeSecurityPrivilege 2564 WMIC.exe Token: SeTakeOwnershipPrivilege 2564 WMIC.exe Token: SeLoadDriverPrivilege 2564 WMIC.exe Token: SeSystemProfilePrivilege 2564 WMIC.exe Token: SeSystemtimePrivilege 2564 WMIC.exe Token: SeProfSingleProcessPrivilege 2564 WMIC.exe Token: SeIncBasePriorityPrivilege 2564 WMIC.exe Token: SeCreatePagefilePrivilege 2564 WMIC.exe Token: SeBackupPrivilege 2564 WMIC.exe Token: SeRestorePrivilege 2564 WMIC.exe Token: SeShutdownPrivilege 2564 WMIC.exe Token: SeDebugPrivilege 2564 WMIC.exe Token: SeSystemEnvironmentPrivilege 2564 WMIC.exe Token: SeRemoteShutdownPrivilege 2564 WMIC.exe Token: SeUndockPrivilege 2564 WMIC.exe Token: SeManageVolumePrivilege 2564 WMIC.exe Token: 33 2564 WMIC.exe Token: 34 2564 WMIC.exe Token: 35 2564 WMIC.exe Token: SeDebugPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeIncreaseQuotaPrivilege 2564 WMIC.exe Token: SeSecurityPrivilege 2564 WMIC.exe Token: SeTakeOwnershipPrivilege 2564 WMIC.exe Token: SeLoadDriverPrivilege 2564 WMIC.exe Token: SeSystemProfilePrivilege 2564 WMIC.exe Token: SeSystemtimePrivilege 2564 WMIC.exe Token: SeProfSingleProcessPrivilege 2564 WMIC.exe Token: SeIncBasePriorityPrivilege 2564 WMIC.exe Token: SeCreatePagefilePrivilege 2564 WMIC.exe Token: SeBackupPrivilege 2564 WMIC.exe Token: SeRestorePrivilege 2564 WMIC.exe Token: SeShutdownPrivilege 2564 WMIC.exe Token: SeDebugPrivilege 2564 WMIC.exe Token: SeSystemEnvironmentPrivilege 2564 WMIC.exe Token: SeRemoteShutdownPrivilege 2564 WMIC.exe Token: SeUndockPrivilege 2564 WMIC.exe Token: SeManageVolumePrivilege 2564 WMIC.exe Token: 33 2564 WMIC.exe Token: 34 2564 WMIC.exe Token: 35 2564 WMIC.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeBackupPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe Token: SeSecurityPrivilege 4052 powershell.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2608 1672 testing.exe 29 PID 1672 wrote to memory of 2608 1672 testing.exe 29 PID 1672 wrote to memory of 2608 1672 testing.exe 29 PID 1672 wrote to memory of 2608 1672 testing.exe 29 PID 2608 wrote to memory of 2716 2608 P1kAlMiG2Kb7.exe 31 PID 2608 wrote to memory of 2716 2608 P1kAlMiG2Kb7.exe 31 PID 2608 wrote to memory of 2716 2608 P1kAlMiG2Kb7.exe 31 PID 2608 wrote to memory of 2716 2608 P1kAlMiG2Kb7.exe 31 PID 2608 wrote to memory of 2720 2608 P1kAlMiG2Kb7.exe 32 PID 2608 wrote to memory of 2720 2608 P1kAlMiG2Kb7.exe 32 PID 2608 wrote to memory of 2720 2608 P1kAlMiG2Kb7.exe 32 PID 2608 wrote to memory of 2720 2608 P1kAlMiG2Kb7.exe 32 PID 2608 wrote to memory of 2796 2608 P1kAlMiG2Kb7.exe 33 PID 2608 wrote to memory of 2796 2608 P1kAlMiG2Kb7.exe 33 PID 2608 wrote to memory of 2796 2608 P1kAlMiG2Kb7.exe 33 PID 2608 wrote to memory of 2796 2608 P1kAlMiG2Kb7.exe 33 PID 2608 wrote to memory of 2820 2608 P1kAlMiG2Kb7.exe 34 PID 2608 wrote to memory of 2820 2608 P1kAlMiG2Kb7.exe 34 PID 2608 wrote to memory of 2820 2608 P1kAlMiG2Kb7.exe 34 PID 2608 wrote to memory of 2820 2608 P1kAlMiG2Kb7.exe 34 PID 2608 wrote to memory of 2704 2608 P1kAlMiG2Kb7.exe 35 PID 2608 wrote to memory of 2704 2608 P1kAlMiG2Kb7.exe 35 PID 2608 wrote to memory of 2704 2608 P1kAlMiG2Kb7.exe 35 PID 2608 wrote to memory of 2704 2608 P1kAlMiG2Kb7.exe 35 PID 2716 wrote to memory of 2564 2716 cmd.exe 36 PID 2716 wrote to memory of 2564 2716 cmd.exe 36 PID 2716 wrote to memory of 2564 2716 cmd.exe 36 PID 2820 wrote to memory of 2016 2820 cmd.exe 37 PID 2820 wrote to memory of 2016 2820 cmd.exe 37 PID 2820 wrote to memory of 2016 2820 cmd.exe 37 PID 2796 wrote to memory of 1984 2796 cmd.exe 38 PID 2796 wrote to memory of 1984 2796 cmd.exe 38 PID 2796 wrote to memory of 1984 2796 cmd.exe 38 PID 2720 wrote to memory of 2484 2720 cmd.exe 39 PID 2720 wrote to memory of 2484 2720 cmd.exe 39 PID 2720 wrote to memory of 2484 2720 cmd.exe 39 PID 2704 wrote to memory of 4052 2704 cmd.exe 40 PID 2704 wrote to memory of 4052 2704 cmd.exe 40 PID 2704 wrote to memory of 4052 2704 cmd.exe 40 PID 2608 wrote to memory of 1052 2608 P1kAlMiG2Kb7.exe 45 PID 2608 wrote to memory of 1052 2608 P1kAlMiG2Kb7.exe 45 PID 2608 wrote to memory of 1052 2608 P1kAlMiG2Kb7.exe 45 PID 2608 wrote to memory of 1052 2608 P1kAlMiG2Kb7.exe 45 PID 1052 wrote to memory of 4512 1052 powershell.exe 46 PID 1052 wrote to memory of 4512 1052 powershell.exe 46 PID 1052 wrote to memory of 4512 1052 powershell.exe 46 PID 1052 wrote to memory of 4544 1052 powershell.exe 47 PID 1052 wrote to memory of 4544 1052 powershell.exe 47 PID 1052 wrote to memory of 4544 1052 powershell.exe 47 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\testing.exe"C:\Users\Admin\AppData\Local\Temp\testing.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\P1kAlMiG2Kb7.exe"C:\Users\Admin\AppData\Local\Temp\P1kAlMiG2Kb7.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\cmd.execmd /c wmic shadowcopy delete /nointeractive3⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
-
C:\Windows\system32\cmd.execmd /c vssadmin.exe Delete Shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:2484
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} recoveryenabled No3⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:1984
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2016
-
-
-
C:\Windows\system32\cmd.execmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$a = [System.IO.File]::ReadAllText(\"Z:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1054300142.png /f4⤵
- Sets desktop wallpaper using registry
PID:4512
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False4⤵PID:4544
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4076
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
807KB
MD5e27b5291c8fb2dfdeb7f16bb6851df5e
SHA140207f83b601cd60905c1f807ac0889c80dfe33f
SHA256ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f
SHA5122ddbc50cd780ffbf73c354b9b437322eb49cb05bb6f287d54e7dcafb61dc4c4549e37ae2f972f3d240bfa7d2ca485b7583137f1bf038bc901f378cea0c305c6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD51514afa0c385087fc6e3476a6cfcee70
SHA135c3deaf84988c1b65b2518304fd021b10043080
SHA2564e347f2fedbde718d57d6b32c3e9132fe6b7006977fe952952a6cdcc06a472a2
SHA512f2881e74f63794075003016bbae966c12c8ccaa6bdc59ec68a09b14bc0033ab84e1aec439678df79f3fde7311f23fd1b7f2da1bd008f251ae35a0edcde8369da
-
Filesize
1011B
MD5c92c2b70fb37f84aab38412ad9226aa8
SHA114f2e9a83285612d0a7b2c83b8f89bccfde6c154
SHA256d64639e873c0873b469cd856d1ef4bce7dc14a80fac6fe2bed9d629f05acc77f
SHA51204f9dcb3cd49909712535255b6eadd7fafcb2902bf1abd5a25e9bb5f5c4dc032611aec0a5b0ec89cd7dbc65276b935c54b906b391507d2e3e3aa65466b15f848