Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 14:47
Static task
static1
Behavioral task
behavioral1
Sample
testing.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
testing.exe
Resource
win10v2004-20241007-en
General
-
Target
testing.exe
-
Size
1.1MB
-
MD5
be4c92abb5de960e3ff065daec9a61c4
-
SHA1
e128502247a2cb7c2b132cd2cc04b131270f83b8
-
SHA256
3bf5c0a99fa71636220da34c352c9cab76426625e9399811515d71612c9b9b06
-
SHA512
10ae6302e1ae52e80d1fc077a3481a0ab28f28c3b58ca6054b73d57fec7d7f260341a63987ad4961f64a223d14ccec9fc8df70a35b6991da0517245c9d695c82
-
SSDEEP
24576:rImw98okVgela0as5CqLVO7XJCjkD3N0HRA:tL5ljasaU
Malware Config
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Avoslocker family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1964 bcdedit.exe 2988 bcdedit.exe -
Renames multiple (10413) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 3012 P1kAlMiG2Kb7.scr -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI P1kAlMiG2Kb7.scr -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: P1kAlMiG2Kb7.scr -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\804791971.png" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD98.POC P1kAlMiG2Kb7.scr File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALSO11.POC P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME38.CSS P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL093.XML P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00017_.WMF P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\PREVIEW.GIF P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GreenTea.css P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD09662_.WMF P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00305_.WMF P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Gibraltar P1kAlMiG2Kb7.scr File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielResume.Dotx P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107192.WMF P1kAlMiG2Kb7.scr File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PREVIEW.GIF P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Windows Media Player\de-DE\wmpnscfg.exe.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi P1kAlMiG2Kb7.scr File created C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.scr File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\TableTextService.dll.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_mid.gif P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6EXT.OLB P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Windows Journal\fr-FR\JNTFiltr.dll.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Windows Mail\ja-JP\msoeres.dll.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONGuide.onepkg P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153299.WMF P1kAlMiG2Kb7.scr File created C:\Program Files\Microsoft Games\FreeCell\en-US\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKACC.CFG P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341557.JPG P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadox28.tlb P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\EScript.api P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Windows Media Player\de-DE\WMPDMCCore.dll.mui P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DVDHM.POC P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV_F_COL.HXK P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0290548.WMF P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig P1kAlMiG2Kb7.scr File created C:\Program Files\Common Files\System\de-DE\GET_YOUR_FILES_BACK.txt P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat P1kAlMiG2Kb7.scr File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01357_.WMF P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_pt_BR.properties P1kAlMiG2Kb7.scr File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak P1kAlMiG2Kb7.scr -
pid Process 620 powershell.exe 5124 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language P1kAlMiG2Kb7.scr -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1700 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3012 P1kAlMiG2Kb7.scr 620 powershell.exe 5124 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3012 P1kAlMiG2Kb7.scr Token: SeIncreaseQuotaPrivilege 1984 WMIC.exe Token: SeSecurityPrivilege 1984 WMIC.exe Token: SeTakeOwnershipPrivilege 1984 WMIC.exe Token: SeLoadDriverPrivilege 1984 WMIC.exe Token: SeSystemProfilePrivilege 1984 WMIC.exe Token: SeSystemtimePrivilege 1984 WMIC.exe Token: SeProfSingleProcessPrivilege 1984 WMIC.exe Token: SeIncBasePriorityPrivilege 1984 WMIC.exe Token: SeCreatePagefilePrivilege 1984 WMIC.exe Token: SeBackupPrivilege 1984 WMIC.exe Token: SeRestorePrivilege 1984 WMIC.exe Token: SeShutdownPrivilege 1984 WMIC.exe Token: SeDebugPrivilege 1984 WMIC.exe Token: SeSystemEnvironmentPrivilege 1984 WMIC.exe Token: SeRemoteShutdownPrivilege 1984 WMIC.exe Token: SeUndockPrivilege 1984 WMIC.exe Token: SeManageVolumePrivilege 1984 WMIC.exe Token: 33 1984 WMIC.exe Token: 34 1984 WMIC.exe Token: 35 1984 WMIC.exe Token: SeBackupPrivilege 716 vssvc.exe Token: SeRestorePrivilege 716 vssvc.exe Token: SeAuditPrivilege 716 vssvc.exe Token: SeIncreaseQuotaPrivilege 1984 WMIC.exe Token: SeSecurityPrivilege 1984 WMIC.exe Token: SeTakeOwnershipPrivilege 1984 WMIC.exe Token: SeLoadDriverPrivilege 1984 WMIC.exe Token: SeSystemProfilePrivilege 1984 WMIC.exe Token: SeSystemtimePrivilege 1984 WMIC.exe Token: SeProfSingleProcessPrivilege 1984 WMIC.exe Token: SeIncBasePriorityPrivilege 1984 WMIC.exe Token: SeCreatePagefilePrivilege 1984 WMIC.exe Token: SeBackupPrivilege 1984 WMIC.exe Token: SeRestorePrivilege 1984 WMIC.exe Token: SeShutdownPrivilege 1984 WMIC.exe Token: SeDebugPrivilege 1984 WMIC.exe Token: SeSystemEnvironmentPrivilege 1984 WMIC.exe Token: SeRemoteShutdownPrivilege 1984 WMIC.exe Token: SeUndockPrivilege 1984 WMIC.exe Token: SeManageVolumePrivilege 1984 WMIC.exe Token: 33 1984 WMIC.exe Token: 34 1984 WMIC.exe Token: 35 1984 WMIC.exe Token: SeDebugPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeSecurityPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeSecurityPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeSecurityPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeSecurityPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeSecurityPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeSecurityPrivilege 620 powershell.exe Token: SeBackupPrivilege 620 powershell.exe Token: SeSecurityPrivilege 620 powershell.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2572 wrote to memory of 3012 2572 testing.exe 32 PID 2572 wrote to memory of 3012 2572 testing.exe 32 PID 2572 wrote to memory of 3012 2572 testing.exe 32 PID 2572 wrote to memory of 3012 2572 testing.exe 32 PID 3012 wrote to memory of 2688 3012 P1kAlMiG2Kb7.scr 34 PID 3012 wrote to memory of 2688 3012 P1kAlMiG2Kb7.scr 34 PID 3012 wrote to memory of 2688 3012 P1kAlMiG2Kb7.scr 34 PID 3012 wrote to memory of 2688 3012 P1kAlMiG2Kb7.scr 34 PID 3012 wrote to memory of 2112 3012 P1kAlMiG2Kb7.scr 35 PID 3012 wrote to memory of 2112 3012 P1kAlMiG2Kb7.scr 35 PID 3012 wrote to memory of 2112 3012 P1kAlMiG2Kb7.scr 35 PID 3012 wrote to memory of 2112 3012 P1kAlMiG2Kb7.scr 35 PID 3012 wrote to memory of 2892 3012 P1kAlMiG2Kb7.scr 36 PID 3012 wrote to memory of 2892 3012 P1kAlMiG2Kb7.scr 36 PID 3012 wrote to memory of 2892 3012 P1kAlMiG2Kb7.scr 36 PID 3012 wrote to memory of 2892 3012 P1kAlMiG2Kb7.scr 36 PID 3012 wrote to memory of 1644 3012 P1kAlMiG2Kb7.scr 37 PID 3012 wrote to memory of 1644 3012 P1kAlMiG2Kb7.scr 37 PID 3012 wrote to memory of 1644 3012 P1kAlMiG2Kb7.scr 37 PID 3012 wrote to memory of 1644 3012 P1kAlMiG2Kb7.scr 37 PID 3012 wrote to memory of 2896 3012 P1kAlMiG2Kb7.scr 38 PID 3012 wrote to memory of 2896 3012 P1kAlMiG2Kb7.scr 38 PID 3012 wrote to memory of 2896 3012 P1kAlMiG2Kb7.scr 38 PID 3012 wrote to memory of 2896 3012 P1kAlMiG2Kb7.scr 38 PID 2688 wrote to memory of 1984 2688 cmd.exe 39 PID 2688 wrote to memory of 1984 2688 cmd.exe 39 PID 2688 wrote to memory of 1984 2688 cmd.exe 39 PID 2892 wrote to memory of 1964 2892 cmd.exe 41 PID 2892 wrote to memory of 1964 2892 cmd.exe 41 PID 2892 wrote to memory of 1964 2892 cmd.exe 41 PID 2112 wrote to memory of 1700 2112 cmd.exe 40 PID 2112 wrote to memory of 1700 2112 cmd.exe 40 PID 2112 wrote to memory of 1700 2112 cmd.exe 40 PID 2896 wrote to memory of 620 2896 cmd.exe 42 PID 2896 wrote to memory of 620 2896 cmd.exe 42 PID 2896 wrote to memory of 620 2896 cmd.exe 42 PID 1644 wrote to memory of 2988 1644 cmd.exe 43 PID 1644 wrote to memory of 2988 1644 cmd.exe 43 PID 1644 wrote to memory of 2988 1644 cmd.exe 43 PID 3012 wrote to memory of 5124 3012 P1kAlMiG2Kb7.scr 48 PID 3012 wrote to memory of 5124 3012 P1kAlMiG2Kb7.scr 48 PID 3012 wrote to memory of 5124 3012 P1kAlMiG2Kb7.scr 48 PID 3012 wrote to memory of 5124 3012 P1kAlMiG2Kb7.scr 48 PID 5124 wrote to memory of 5528 5124 powershell.exe 49 PID 5124 wrote to memory of 5528 5124 powershell.exe 49 PID 5124 wrote to memory of 5528 5124 powershell.exe 49 PID 5124 wrote to memory of 5388 5124 powershell.exe 50 PID 5124 wrote to memory of 5388 5124 powershell.exe 50 PID 5124 wrote to memory of 5388 5124 powershell.exe 50 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\testing.exe"C:\Users\Admin\AppData\Local\Temp\testing.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\P1kAlMiG2Kb7.scr"C:\Users\Admin\AppData\Local\Temp\P1kAlMiG2Kb7.scr" /S2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\cmd.execmd /c wmic shadowcopy delete /nointeractive3⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
-
C:\Windows\system32\cmd.execmd /c vssadmin.exe Delete Shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:1700
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} recoveryenabled No3⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:1964
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2988
-
-
-
C:\Windows\system32\cmd.execmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"3⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$a = [System.IO.File]::ReadAllText(\"F:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\804791971.png /f4⤵
- Sets desktop wallpaper using registry
PID:5528
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False4⤵PID:5388
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:716
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
807KB
MD5e27b5291c8fb2dfdeb7f16bb6851df5e
SHA140207f83b601cd60905c1f807ac0889c80dfe33f
SHA256ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f
SHA5122ddbc50cd780ffbf73c354b9b437322eb49cb05bb6f287d54e7dcafb61dc4c4549e37ae2f972f3d240bfa7d2ca485b7583137f1bf038bc901f378cea0c305c6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD540ef8f2c6ef23a87b4cab7ab360113f6
SHA11d37e5ce5617d737c62909fa354025a39eb605c7
SHA256548e4a02ef58bf448763744b23db63161a427c88bee4105eed40354118de3f0d
SHA512ca4882c3db4b4c052a9ae3604791b10d8b1367ad6ee7406e1659c8374a9b972245b0710bd8bb892a2ddf6e27eeb4d87548b4b48349329a153f49ff67a622b2fc
-
Filesize
1011B
MD5c92c2b70fb37f84aab38412ad9226aa8
SHA114f2e9a83285612d0a7b2c83b8f89bccfde6c154
SHA256d64639e873c0873b469cd856d1ef4bce7dc14a80fac6fe2bed9d629f05acc77f
SHA51204f9dcb3cd49909712535255b6eadd7fafcb2902bf1abd5a25e9bb5f5c4dc032611aec0a5b0ec89cd7dbc65276b935c54b906b391507d2e3e3aa65466b15f848