Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-12-2024 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
test.exe
Resource
win7-20240903-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
test.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
23 signatures
150 seconds
General
-
Target
test.exe
-
Size
3.2MB
-
MD5
b04b6f1b897e829ff58dc99f18be1a8a
-
SHA1
9a99cc16e540e341655a259650caf58ec14956ac
-
SHA256
962da1faf888b28b2ec26fd1ea547fecfb2edc1cf30e64328b18309e98448b11
-
SHA512
7e2f9c691d23288fddad062f4c3e197ab84010c03418088b10060a5c720d34b153937e68b72ba13a6819eefd0d15c8a3e280fb1bbb4771d22566c7fb6838f07b
-
SSDEEP
24576:4Imw98okVgela0as5CqLVO7XJCjkD3N0HRAjSUpZr3y2amHY6MdefqTXeZty61ky:OL5ljasaUoZat81wua7bUScTLTXO+2N
Malware Config
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Avoslocker family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3388 bcdedit.exe 3236 bcdedit.exe -
Renames multiple (10382) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1988 hack.exe 596 rufus-4.6p.exe -
Loads dropped DLL 1 IoCs
pid Process 1144 test.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI hack.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: hack.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\67869465.png" reg.exe -
resource yara_rule behavioral1/files/0x0008000000016c73-10.dat upx behavioral1/memory/596-11-0x000000013F800000-0x000000013FC6E000-memory.dmp upx behavioral1/memory/596-13-0x000000013F800000-0x000000013FC6E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217872.WMF hack.exe File opened for modification C:\Program Files (x86)\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui hack.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\adovbs.inc hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\slideShow.css hack.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\settings.css hack.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado21.tlb hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\currency.css hack.exe File created C:\Program Files\Windows NT\Accessories\de-DE\GET_YOUR_FILES_BACK.txt hack.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03459_.WMF hack.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar hack.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr hack.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18238_.WMF hack.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\AXIS.INF hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages.properties hack.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\GET_YOUR_FILES_BACK.txt hack.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn hack.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImagesMask.bmp hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02166_.WMF hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar hack.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanReport.Dotx hack.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\GET_YOUR_FILES_BACK.txt hack.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js hack.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie hack.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01297_.GIF hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\weather.js hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\TexturedBlue.css hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR36B.GIF hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107514.WMF hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_01.MID hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099164.WMF hack.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css hack.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png hack.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui hack.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216516.WMF hack.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195772.WMF hack.exe File created C:\Program Files (x86)\Common Files\System\MSMAPI\1033\GET_YOUR_FILES_BACK.txt hack.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png hack.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html hack.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png hack.exe File opened for modification C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui hack.exe -
pid Process 3532 powershell.exe 216 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hack.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3828 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1988 hack.exe 3532 powershell.exe 216 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1988 hack.exe Token: SeIncreaseQuotaPrivilege 2000 WMIC.exe Token: SeSecurityPrivilege 2000 WMIC.exe Token: SeTakeOwnershipPrivilege 2000 WMIC.exe Token: SeLoadDriverPrivilege 2000 WMIC.exe Token: SeSystemProfilePrivilege 2000 WMIC.exe Token: SeSystemtimePrivilege 2000 WMIC.exe Token: SeProfSingleProcessPrivilege 2000 WMIC.exe Token: SeIncBasePriorityPrivilege 2000 WMIC.exe Token: SeCreatePagefilePrivilege 2000 WMIC.exe Token: SeBackupPrivilege 2000 WMIC.exe Token: SeRestorePrivilege 2000 WMIC.exe Token: SeShutdownPrivilege 2000 WMIC.exe Token: SeDebugPrivilege 2000 WMIC.exe Token: SeSystemEnvironmentPrivilege 2000 WMIC.exe Token: SeRemoteShutdownPrivilege 2000 WMIC.exe Token: SeUndockPrivilege 2000 WMIC.exe Token: SeManageVolumePrivilege 2000 WMIC.exe Token: 33 2000 WMIC.exe Token: 34 2000 WMIC.exe Token: 35 2000 WMIC.exe Token: SeDebugPrivilege 3532 powershell.exe Token: SeIncreaseQuotaPrivilege 2000 WMIC.exe Token: SeSecurityPrivilege 2000 WMIC.exe Token: SeTakeOwnershipPrivilege 2000 WMIC.exe Token: SeLoadDriverPrivilege 2000 WMIC.exe Token: SeSystemProfilePrivilege 2000 WMIC.exe Token: SeSystemtimePrivilege 2000 WMIC.exe Token: SeProfSingleProcessPrivilege 2000 WMIC.exe Token: SeIncBasePriorityPrivilege 2000 WMIC.exe Token: SeCreatePagefilePrivilege 2000 WMIC.exe Token: SeBackupPrivilege 2000 WMIC.exe Token: SeRestorePrivilege 2000 WMIC.exe Token: SeShutdownPrivilege 2000 WMIC.exe Token: SeDebugPrivilege 2000 WMIC.exe Token: SeSystemEnvironmentPrivilege 2000 WMIC.exe Token: SeRemoteShutdownPrivilege 2000 WMIC.exe Token: SeUndockPrivilege 2000 WMIC.exe Token: SeManageVolumePrivilege 2000 WMIC.exe Token: 33 2000 WMIC.exe Token: 34 2000 WMIC.exe Token: 35 2000 WMIC.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeSecurityPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3844 vssvc.exe Token: SeRestorePrivilege 3844 vssvc.exe Token: SeAuditPrivilege 3844 vssvc.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeSecurityPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeSecurityPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeSecurityPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeSecurityPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeSecurityPrivilege 3532 powershell.exe Token: SeBackupPrivilege 3532 powershell.exe Token: SeSecurityPrivilege 3532 powershell.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1988 1144 test.exe 30 PID 1144 wrote to memory of 1988 1144 test.exe 30 PID 1144 wrote to memory of 1988 1144 test.exe 30 PID 1144 wrote to memory of 1988 1144 test.exe 30 PID 1144 wrote to memory of 596 1144 test.exe 32 PID 1144 wrote to memory of 596 1144 test.exe 32 PID 1144 wrote to memory of 596 1144 test.exe 32 PID 1988 wrote to memory of 2264 1988 hack.exe 33 PID 1988 wrote to memory of 2264 1988 hack.exe 33 PID 1988 wrote to memory of 2264 1988 hack.exe 33 PID 1988 wrote to memory of 2264 1988 hack.exe 33 PID 1988 wrote to memory of 2488 1988 hack.exe 34 PID 1988 wrote to memory of 2488 1988 hack.exe 34 PID 1988 wrote to memory of 2488 1988 hack.exe 34 PID 1988 wrote to memory of 2488 1988 hack.exe 34 PID 1988 wrote to memory of 2288 1988 hack.exe 35 PID 1988 wrote to memory of 2288 1988 hack.exe 35 PID 1988 wrote to memory of 2288 1988 hack.exe 35 PID 1988 wrote to memory of 2288 1988 hack.exe 35 PID 1988 wrote to memory of 2500 1988 hack.exe 36 PID 1988 wrote to memory of 2500 1988 hack.exe 36 PID 1988 wrote to memory of 2500 1988 hack.exe 36 PID 1988 wrote to memory of 2500 1988 hack.exe 36 PID 1988 wrote to memory of 2108 1988 hack.exe 37 PID 1988 wrote to memory of 2108 1988 hack.exe 37 PID 1988 wrote to memory of 2108 1988 hack.exe 37 PID 1988 wrote to memory of 2108 1988 hack.exe 37 PID 2264 wrote to memory of 2000 2264 cmd.exe 38 PID 2264 wrote to memory of 2000 2264 cmd.exe 38 PID 2264 wrote to memory of 2000 2264 cmd.exe 38 PID 2500 wrote to memory of 3236 2500 cmd.exe 39 PID 2500 wrote to memory of 3236 2500 cmd.exe 39 PID 2500 wrote to memory of 3236 2500 cmd.exe 39 PID 2288 wrote to memory of 3388 2288 cmd.exe 40 PID 2288 wrote to memory of 3388 2288 cmd.exe 40 PID 2288 wrote to memory of 3388 2288 cmd.exe 40 PID 2108 wrote to memory of 3532 2108 cmd.exe 41 PID 2108 wrote to memory of 3532 2108 cmd.exe 41 PID 2108 wrote to memory of 3532 2108 cmd.exe 41 PID 2488 wrote to memory of 3828 2488 cmd.exe 42 PID 2488 wrote to memory of 3828 2488 cmd.exe 42 PID 2488 wrote to memory of 3828 2488 cmd.exe 42 PID 1988 wrote to memory of 216 1988 hack.exe 48 PID 1988 wrote to memory of 216 1988 hack.exe 48 PID 1988 wrote to memory of 216 1988 hack.exe 48 PID 1988 wrote to memory of 216 1988 hack.exe 48 PID 216 wrote to memory of 220 216 powershell.exe 49 PID 216 wrote to memory of 220 216 powershell.exe 49 PID 216 wrote to memory of 220 216 powershell.exe 49 PID 216 wrote to memory of 200 216 powershell.exe 50 PID 216 wrote to memory of 200 216 powershell.exe 50 PID 216 wrote to memory of 200 216 powershell.exe 50 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\hack.exe"C:\Users\Admin\AppData\Local\Temp\hack.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\cmd.execmd /c wmic shadowcopy delete /nointeractive3⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete /nointeractive4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000
-
-
-
C:\Windows\system32\cmd.execmd /c vssadmin.exe Delete Shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:3828
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} recoveryenabled No3⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
PID:3388
-
-
-
C:\Windows\system32\cmd.execmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:3236
-
-
-
C:\Windows\system32\cmd.execmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"3⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3532
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$a = [System.IO.File]::ReadAllText(\"F:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\67869465.png /f4⤵
- Sets desktop wallpaper using registry
PID:220
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False4⤵PID:200
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rufus-4.6p.exe"C:\Users\Admin\AppData\Local\Temp\rufus-4.6p.exe"2⤵
- Executes dropped EXE
PID:596
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3844
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
807KB
MD5e27b5291c8fb2dfdeb7f16bb6851df5e
SHA140207f83b601cd60905c1f807ac0889c80dfe33f
SHA256ffd933ad53f22a0f10cceb4986087258f72dffdd36999b7014c6b37c157ee45f
SHA5122ddbc50cd780ffbf73c354b9b437322eb49cb05bb6f287d54e7dcafb61dc4c4549e37ae2f972f3d240bfa7d2ca485b7583137f1bf038bc901f378cea0c305c6a
-
Filesize
1.5MB
MD58fe64da09af371b02a31828415ece8f3
SHA15b5c90dcd425c814b555a4567405601aa977ee0b
SHA2568279696c1d78b14618500e9135886a3667b9decc65946f3729002e4bfdbb20ab
SHA512e49f9b1c9d33364101ad2fd4f2c5ed030700cc941bb469cf2ce7d5b32c51cab9e62b265e05cbd92435453e7e4008c9990bea532298676f7d81e5d6dcdc2f590b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD592ad4dd95390f5d5cc8dffc2517b49f5
SHA1bb017312a29670013677f360b679b220985d0986
SHA2568c7a90e7538164ffea9268c23de62d0c25b77b4ed4c7bb00d558d24ba5c20e12
SHA512a8956d5cae417360972a28245282ef34d87f47a3152ba8922b3269a0e974f2c0792bee3e9c8ae14d34a7f068e664e37057ef275d241c71f61c7caa2e68c2b9c7
-
Filesize
1011B
MD5c92c2b70fb37f84aab38412ad9226aa8
SHA114f2e9a83285612d0a7b2c83b8f89bccfde6c154
SHA256d64639e873c0873b469cd856d1ef4bce7dc14a80fac6fe2bed9d629f05acc77f
SHA51204f9dcb3cd49909712535255b6eadd7fafcb2902bf1abd5a25e9bb5f5c4dc032611aec0a5b0ec89cd7dbc65276b935c54b906b391507d2e3e3aa65466b15f848