Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 13:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
testing.exe
Resource
win7-20240903-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
testing.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
testing.exe
-
Size
1.1MB
-
MD5
9bab6ed20e3975cec860894d96f1de7c
-
SHA1
b4647855c5f313fadc03347ea10272fda260dd22
-
SHA256
368041501211167866ce2f39dfd64e596707763d2c9e448565e28d92c649aa71
-
SHA512
14c5d8c19429aebfc5ed678d56de3b3d53e2272eda11567d85723933bbca600e00eeb52e5562278c67b08ac87b6c1bc45b6dc8b653a8d545d1edd8c8aa78432a
-
SSDEEP
24576:tImw98okVgela0as5CqLVO7XJCjkD3N0HRA:DL5ljasaU
Malware Config
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Avoslocker family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 768 bcdedit.exe 4684 bcdedit.exe -
Renames multiple (8476) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation testing.exe -
Executes dropped EXE 1 IoCs
pid Process 1088 P1kAlMiG2Kb7.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI P1kAlMiG2Kb7.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: P1kAlMiG2Kb7.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1247608375.png" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\uk-ua\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Internet Explorer\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\print_poster.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\es-es\ui-strings.js P1kAlMiG2Kb7.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-200.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nothumbnail_34.svg P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_uinline_warning.svg P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\CourierStd.otf P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\es-es\ui-strings.js P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js P1kAlMiG2Kb7.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\LICENSE.DATA P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-200.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-400.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\javaws.jar P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\glib.md P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\da-dk\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ja-jp\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\es-es\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\cs-cz\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\SmallLogo.png.DATA P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\is.pak.DATA P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Notifications\SoftLandingAssetDark.gif P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\de-DE\msdaorar.dll.mui P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ui-strings.js P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons2x.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File created C:\Program Files\MSBuild\Microsoft\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_18.svg P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-125.png P1kAlMiG2Kb7.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\REFINED.ELM P1kAlMiG2Kb7.exe -
pid Process 3024 powershell.exe 38660 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language P1kAlMiG2Kb7.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 876 vssadmin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 24632 vlc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1088 P1kAlMiG2Kb7.exe 1088 P1kAlMiG2Kb7.exe 3024 powershell.exe 3024 powershell.exe 3024 powershell.exe 38660 powershell.exe 38660 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 24632 vlc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1088 P1kAlMiG2Kb7.exe Token: SeIncreaseQuotaPrivilege 4784 WMIC.exe Token: SeSecurityPrivilege 4784 WMIC.exe Token: SeTakeOwnershipPrivilege 4784 WMIC.exe Token: SeLoadDriverPrivilege 4784 WMIC.exe Token: SeSystemProfilePrivilege 4784 WMIC.exe Token: SeSystemtimePrivilege 4784 WMIC.exe Token: SeProfSingleProcessPrivilege 4784 WMIC.exe Token: SeIncBasePriorityPrivilege 4784 WMIC.exe Token: SeCreatePagefilePrivilege 4784 WMIC.exe Token: SeBackupPrivilege 4784 WMIC.exe Token: SeRestorePrivilege 4784 WMIC.exe Token: SeShutdownPrivilege 4784 WMIC.exe Token: SeDebugPrivilege 4784 WMIC.exe Token: SeSystemEnvironmentPrivilege 4784 WMIC.exe Token: SeRemoteShutdownPrivilege 4784 WMIC.exe Token: SeUndockPrivilege 4784 WMIC.exe Token: SeManageVolumePrivilege 4784 WMIC.exe Token: 33 4784 WMIC.exe Token: 34 4784 WMIC.exe Token: 35 4784 WMIC.exe Token: 36 4784 WMIC.exe Token: SeIncreaseQuotaPrivilege 4784 WMIC.exe Token: SeSecurityPrivilege 4784 WMIC.exe Token: SeTakeOwnershipPrivilege 4784 WMIC.exe Token: SeLoadDriverPrivilege 4784 WMIC.exe Token: SeSystemProfilePrivilege 4784 WMIC.exe Token: SeSystemtimePrivilege 4784 WMIC.exe Token: SeProfSingleProcessPrivilege 4784 WMIC.exe Token: SeIncBasePriorityPrivilege 4784 WMIC.exe Token: SeCreatePagefilePrivilege 4784 WMIC.exe Token: SeBackupPrivilege 4784 WMIC.exe Token: SeRestorePrivilege 4784 WMIC.exe Token: SeShutdownPrivilege 4784 WMIC.exe Token: SeDebugPrivilege 4784 WMIC.exe Token: SeSystemEnvironmentPrivilege 4784 WMIC.exe Token: SeRemoteShutdownPrivilege 4784 WMIC.exe Token: SeUndockPrivilege 4784 WMIC.exe Token: SeManageVolumePrivilege 4784 WMIC.exe Token: 33 4784 WMIC.exe Token: 34 4784 WMIC.exe Token: 35 4784 WMIC.exe Token: 36 4784 WMIC.exe Token: SeBackupPrivilege 38580 vssvc.exe Token: SeRestorePrivilege 38580 vssvc.exe Token: SeAuditPrivilege 38580 vssvc.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeSecurityPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeSecurityPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeSecurityPrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 24632 vlc.exe 24632 vlc.exe 24632 vlc.exe 24632 vlc.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 24632 vlc.exe 24632 vlc.exe 24632 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 24632 vlc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1088 2500 testing.exe 86 PID 2500 wrote to memory of 1088 2500 testing.exe 86 PID 2500 wrote to memory of 1088 2500 testing.exe 86 PID 1088 wrote to memory of 5088 1088 P1kAlMiG2Kb7.exe 88 PID 1088 wrote to memory of 5088 1088 P1kAlMiG2Kb7.exe 88 PID 1088 wrote to memory of 3460 1088 P1kAlMiG2Kb7.exe 89 PID 1088 wrote to memory of 3460 1088 P1kAlMiG2Kb7.exe 89 PID 1088 wrote to memory of 2000 1088 P1kAlMiG2Kb7.exe 90 PID 1088 wrote to memory of 2000 1088 P1kAlMiG2Kb7.exe 90 PID 1088 wrote to memory of 3112 1088 P1kAlMiG2Kb7.exe 91 PID 1088 wrote to memory of 3112 1088 P1kAlMiG2Kb7.exe 91 PID 1088 wrote to memory of 3016 1088 P1kAlMiG2Kb7.exe 92 PID 1088 wrote to memory of 3016 1088 P1kAlMiG2Kb7.exe 92 PID 3460 wrote to memory of 876 3460 cmd.exe 93 PID 3460 wrote to memory of 876 3460 cmd.exe 93 PID 3016 wrote to memory of 3024 3016 cmd.exe 95 PID 3016 wrote to memory of 3024 3016 cmd.exe 95 PID 3112 wrote to memory of 768 3112 cmd.exe 94 PID 3112 wrote to memory of 768 3112 cmd.exe 94 PID 2000 wrote to memory of 4684 2000 cmd.exe 96 PID 2000 wrote to memory of 4684 2000 cmd.exe 96 PID 5088 wrote to memory of 4784 5088 cmd.exe 97 PID 5088 wrote to memory of 4784 5088 cmd.exe 97 PID 1088 wrote to memory of 38660 1088 P1kAlMiG2Kb7.exe 102 PID 1088 wrote to memory of 38660 1088 P1kAlMiG2Kb7.exe 102 PID 38660 wrote to memory of 17756 38660 powershell.exe 103 PID 38660 wrote to memory of 17756 38660 powershell.exe 103 PID 38660 wrote to memory of 17916 38660 powershell.exe 104 PID 38660 wrote to memory of 17916 38660 powershell.exe 104 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\testing.exe"C:\Users\Admin\AppData\Local\Temp\testing.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\P1kAlMiG2Kb7.exe"C:\Users\Admin\AppData\Local\Temp\P1kAlMiG2Kb7.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SYSTEM32\cmd.execmd /c wmic shadowcopy delete /nointeractive3⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c vssadmin.exe Delete Shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:876
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c bcdedit /set {default} recoveryenabled No3⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:4684
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:768
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"3⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$a = [System.IO.File]::ReadAllText(\"F:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:38660 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1247608375.png /f4⤵
- Sets desktop wallpaper using registry
PID:17756
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False4⤵PID:17916
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:38580
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:24632
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
1KB
MD5f41e608cfdcf9e9d1056a52104b47e46
SHA1448c9257d0af3200a0ee9fc991f8ac1888e0cf38
SHA25669dc1f8322d399c577189c50aecf322c56783b94372c4b431b9b2ef4c7c2ea91
SHA5120ab455929c1c20e0e2dcb1dc71b70335681a56ba694d3cf8aa250fce7e30be29292b44d3cbafd84e75edcdfd1bf202fe0b3fd7f8e2572f8249ef0b1deb52e3c5
-
Filesize
807KB
MD5e27b5291c8fb2dfdeb7f16bb6851df5e
SHA140207f83b601cd60905c1f807ac0889c80dfe33f
SHA256ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f
SHA5122ddbc50cd780ffbf73c354b9b437322eb49cb05bb6f287d54e7dcafb61dc4c4549e37ae2f972f3d240bfa7d2ca485b7583137f1bf038bc901f378cea0c305c6a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1011B
MD5c92c2b70fb37f84aab38412ad9226aa8
SHA114f2e9a83285612d0a7b2c83b8f89bccfde6c154
SHA256d64639e873c0873b469cd856d1ef4bce7dc14a80fac6fe2bed9d629f05acc77f
SHA51204f9dcb3cd49909712535255b6eadd7fafcb2902bf1abd5a25e9bb5f5c4dc032611aec0a5b0ec89cd7dbc65276b935c54b906b391507d2e3e3aa65466b15f848