avaddon | 1d1feaab709be09d383912b6e73ae410bb7733563a5449d3739bf608e82fca56

Resubmissions

26/02/2025, 16:43

250226-t8l7aawtcw 10

Analysis

max time kernel
128s
max time network
122s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
23/02/2025, 21:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Size

483KB
MD5

53717dc73f61b0f9551cb62d6fca2e4a
SHA1

1ca9304e86632b147852767c85c57e08bdfc8855
SHA256

c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028
SHA512

ae6ff8377d89cd3d1686c5a6bd7bb398bb975e4e52f7db5fbb0550783d77648558f03a13a9751d0cb6ed993621b12980d54777385802dd4c014ec22ae8d33552
SSDEEP

12288:WcvbX8rMmSZJ8t9ZITyDpFGIOyA4muT5WFExk8y:/zMr1SZJ8t9ZITyNzOt4dVy

Score

10^/10

avaddon defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\NwdG4iYr_readme_.txt

Family

avaddon

Ransom Note

-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .dddeEBDcE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MTgwNS1LdkNVdEZHL2hkem9wdEszKzdjbzNnbHBzYjR0K2pueGxFNXQ4cWM2djFYQS9Cc24wS0xpeGFxK1Vob1ZrQzV0bkJJYjdsMDE2OUhvOWF0a1g5b3NYeGNkUFJGeDZNNEhSbXVGdUhZVjlFaUVrcVI4MzFvN3o3WjBGeTlEK1RQYTJ4WjZhSytMTkJvdnd6WENLcENqWEJBY2NBZUpUM0F0eGdmUmFUOGxWenNDMmNPb21jb01rK2c5REE2cUJ0Y01hZzBuWkMwQ0xtRE5XY1dwZjlxZkhuU1VrWlZ1SXpjTnJpOENXVDVBNWxZdzdIcUZ4YTZUNEJMV3FmR2o2U1dEQ2l6Ukw3Y1Y0OGJMK084MDU4MVh4cDFGY0dFeUx2US9reUhGYlBjWXBwM3BvUXBhRjFVZndNTjI2R2tuTVdQWGtKcmV6VmlSeGlWZmtzWE5jOTQ4SHhsc3pwTTVMb0RsalFNSmF1U3ZVeFhTbEpoaVkvMmRLcWZPaGxrY2FHQjM0VHJ1dlF1Qzl0bXVYV1lxU0Q2Nm1kNERWZ0kyT2JMbVVUZnVpclJXU2l1ajNvdW1jbEtqWENpbEtZUHE4L1hRVG1JUy9UWUhDbmN4K1czcHRpbWxKWFA2SGh3NWp0OWFhbzRRK0ZaNkE4S0dic2ZSN1VNUGYrTy9YSTE1VEphYXhsUjJKcTVBR3g1aVJ2ZXQ0ZFZBeTVHVWVRQnFnMWx1M0diazAyck9QbnNhZ3RuUzl1U0V2dmtJRWlZTjl2SHp0eTZWNU1TaDRNN1dpa3p0UURZVnpMd1dBVHdzcnRUWUlwcXMvUGdVaVMyK0hRMERuRkpySVRqdm13UU5qc0Z1YWVlQ2pTTGhpaVY5cVBQNER0eFlOTzBsdmdFY1plUWMwZmFEYSs5TWhuRk56eHlOaXpoL0FNMUVLR3Eyajl4UExIbVZSWjVpTVZEOXJPMjM4ZUZzZWJkUXRoTC9KV0xDam5ZVUtMV3p3V1o2UlJRd3VjWEsxVXgzQy8wbDJDMkJFc3BmeHBsUjRVY0lFKzJGQldBaHpFUVdEbDVOSXE5MEhsSVIydlV6d0NCc2VWbVAyb0hIVWt0ME0zNXB2dk5XUHZuUnZjem9uVy9rYnN1Z3ZCOWlTVDBWaW5sSHM2Q0dvaitFZzZ6dTc2T1NjQlhxZ3E5NW1PRVNuNHhiSzdoaDdmMm9HM25CSXliaFBBN1BzSHdUUFFPd2IyUXpTRXkzaFByZzVMS1o2MCtTZWtKR1NHZ1QrazdEZE94dFdsODA4SjNwQ0NRNnZtRUwvZDkxemo4dk50TDlCZVhYSkpySnNWVE4zMFdmVHdVT21KelYzSTRPWmpON2Vpb0NHUllMc3k5VzZ3TmpmT1RpNFNJYnY0MnB4dWhVR2x2cnRrRkx1bjdBQWxmYUdDZlBqMTlHU3JvRUdkRUlpc0pXU2h0cUt1M3QwcmJNdC9xdkxpNENlVFZpSE9SaytuNUE3U3FtVDJ1RWt3U1JrbVFBMjNyL3gxYmw5eU44aktvWUR5eUdNSk1yYUM5UTg5c3hNQkp1TVlhRDNkZEpXQlE4Q0kxVmhOZUk3VlFKSmQ5RHlTSDRJSDRRdURnQi9nV1dmbjhoWlQ5MWwybys0M0tLYTN2eWkzZWFDRWloaThJM3VwU015R2kyUjhBeXBQNkQ2QUlPVTAva1MvZkJ4MUU2VGowRHhYRmh1dmN3aklqemVkaGI0YUFrdUduUk5Bb0E1VG1XYmpHenlYTkxPU0hUemlhYVpaZ3JrQjRqVlY0Q0lIQis1cWFKZkFPaUltVkp0MWgzSHpSU2ptZVkybEJrTkhVMU5xOFh0dTFGcGkzMmxkUXRBS1lHRHoyYVNJRHFHcGNVWWxHbjhwNi9BSFlKbHV4cEJWSlpKVEdlVHF0S29HVm5zb1cwbU85YktCNlplVXFmbDFaQWwxQm05ZVJTRWJoaURvTjdEUElJS2dIMnkxb1k3VTBvMGlmb0YvMGt6VDFnR3BMTFRySVVLR2ZSZXEveHNPRUoyNGpORUp3eWNYU0dtNUpNZ1Q5cHJMV1dSZGF2bVRXN1JtT2Jad0pYQ2hCRHFaR0VNUGFZekJhVmluOTR1bUFvdW5pdm1LaWVUYXgxUzNVMmp0Qll4V2JkV0RVL3l3OFJyUT09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * kYkcPvLfKhweTLNW

URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Documents\NwdG4iYr_readme_.txt

Family

avaddon

Ransom Note

URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Favorites\Microsoft Websites\NwdG4iYr_readme_.txt

Family

avaddon

Ransom Note

URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Public\Music\Sample Music\NwdG4iYr_readme_.txt

Family

avaddon

Ransom Note

URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Signatures

Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
ransomware avaddon
Avaddon family
avaddon
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (178) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\S:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\U:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\V:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\P:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\Q:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\B:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\E:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\G:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\H:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\I:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\K:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\A:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\J:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\N:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\M:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\W:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\F:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\O:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\L:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\T:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\X:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\Y:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
File opened (read-only)	\??\Z:	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3032	vssadmin.exe
2828	vssadmin.exe
632	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2852	wmic.exe
Token: SeSecurityPrivilege	2852	wmic.exe
Token: SeTakeOwnershipPrivilege	2852	wmic.exe
Token: SeLoadDriverPrivilege	2852	wmic.exe
Token: SeSystemProfilePrivilege	2852	wmic.exe
Token: SeSystemtimePrivilege	2852	wmic.exe
Token: SeProfSingleProcessPrivilege	2852	wmic.exe
Token: SeIncBasePriorityPrivilege	2852	wmic.exe
Token: SeCreatePagefilePrivilege	2852	wmic.exe
Token: SeBackupPrivilege	2852	wmic.exe
Token: SeRestorePrivilege	2852	wmic.exe
Token: SeShutdownPrivilege	2852	wmic.exe
Token: SeDebugPrivilege	2852	wmic.exe
Token: SeSystemEnvironmentPrivilege	2852	wmic.exe
Token: SeRemoteShutdownPrivilege	2852	wmic.exe
Token: SeUndockPrivilege	2852	wmic.exe
Token: SeManageVolumePrivilege	2852	wmic.exe
Token: 33	2852	wmic.exe
Token: 34	2852	wmic.exe
Token: 35	2852	wmic.exe
Token: SeIncreaseQuotaPrivilege	2852	wmic.exe
Token: SeSecurityPrivilege	2852	wmic.exe
Token: SeTakeOwnershipPrivilege	2852	wmic.exe
Token: SeLoadDriverPrivilege	2852	wmic.exe
Token: SeSystemProfilePrivilege	2852	wmic.exe
Token: SeSystemtimePrivilege	2852	wmic.exe
Token: SeProfSingleProcessPrivilege	2852	wmic.exe
Token: SeIncBasePriorityPrivilege	2852	wmic.exe
Token: SeCreatePagefilePrivilege	2852	wmic.exe
Token: SeBackupPrivilege	2852	wmic.exe
Token: SeRestorePrivilege	2852	wmic.exe
Token: SeShutdownPrivilege	2852	wmic.exe
Token: SeDebugPrivilege	2852	wmic.exe
Token: SeSystemEnvironmentPrivilege	2852	wmic.exe
Token: SeRemoteShutdownPrivilege	2852	wmic.exe
Token: SeUndockPrivilege	2852	wmic.exe
Token: SeManageVolumePrivilege	2852	wmic.exe
Token: 33	2852	wmic.exe
Token: 34	2852	wmic.exe
Token: 35	2852	wmic.exe
Token: SeBackupPrivilege	2748	vssvc.exe
Token: SeRestorePrivilege	2748	vssvc.exe
Token: SeAuditPrivilege	2748	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2804	wmic.exe
Token: SeSecurityPrivilege	2804	wmic.exe
Token: SeTakeOwnershipPrivilege	2804	wmic.exe
Token: SeLoadDriverPrivilege	2804	wmic.exe
Token: SeSystemProfilePrivilege	2804	wmic.exe
Token: SeSystemtimePrivilege	2804	wmic.exe
Token: SeProfSingleProcessPrivilege	2804	wmic.exe
Token: SeIncBasePriorityPrivilege	2804	wmic.exe
Token: SeCreatePagefilePrivilege	2804	wmic.exe
Token: SeBackupPrivilege	2804	wmic.exe
Token: SeRestorePrivilege	2804	wmic.exe
Token: SeShutdownPrivilege	2804	wmic.exe
Token: SeDebugPrivilege	2804	wmic.exe
Token: SeSystemEnvironmentPrivilege	2804	wmic.exe
Token: SeRemoteShutdownPrivilege	2804	wmic.exe
Token: SeUndockPrivilege	2804	wmic.exe
Token: SeManageVolumePrivilege	2804	wmic.exe
Token: 33	2804	wmic.exe
Token: 34	2804	wmic.exe
Token: 35	2804	wmic.exe
Token: SeIncreaseQuotaPrivilege	2804	wmic.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2852	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	30
PID 2772 wrote to memory of 2852	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	30
PID 2772 wrote to memory of 2852	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	30
PID 2772 wrote to memory of 2852	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	30
PID 2772 wrote to memory of 3032	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	34
PID 2772 wrote to memory of 3032	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	34
PID 2772 wrote to memory of 3032	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	34
PID 2772 wrote to memory of 3032	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	34
PID 2772 wrote to memory of 2804	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	36
PID 2772 wrote to memory of 2804	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	36
PID 2772 wrote to memory of 2804	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	36
PID 2772 wrote to memory of 2804	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	36
PID 2772 wrote to memory of 2828	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	38
PID 2772 wrote to memory of 2828	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	38
PID 2772 wrote to memory of 2828	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	38
PID 2772 wrote to memory of 2828	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	38
PID 2772 wrote to memory of 1072	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	40
PID 2772 wrote to memory of 1072	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	40
PID 2772 wrote to memory of 1072	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	40
PID 2772 wrote to memory of 1072	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	40
PID 2772 wrote to memory of 632	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	42
PID 2772 wrote to memory of 632	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	42
PID 2772 wrote to memory of 632	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	42
PID 2772 wrote to memory of 632	2772	c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe	42

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
"C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic SHADOWCOPY DELETE /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:3032
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic SHADOWCOPY DELETE /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:2828
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic SHADOWCOPY DELETE /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1072
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin Delete Shadows /All /Quiet
  2⤵
  - System Location Discovery: System Language Discovery
  - Interacts with shadow copies
  PID:632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\NwdG4iYr_readme_.txt

Filesize
3KB

MD5
1abf227421f6421b13dc4a2d36ab7b51

SHA1
a5e94fcbf12f54f33352b11ef77dfc0cbb7f2236

SHA256
fd68dc91d0a157d6bf2daefb627c08a3a552f73287d396559823f9bc2ca96148

SHA512
fd03696722184a0595a7ad45e4bc544afb842f0249f5927091e52da9ba63d4a59c3282fb6abb9c26fb9a508d8bcac71d1cb85cd63cff899453b93112bf7b5e67

Download Submit
C:\Users\Admin\Documents\NwdG4iYr_readme_.txt

Filesize
3KB

MD5
04bd57ef86c6afaf3b832e34b7c1f87e

SHA1
7784a42237edee8553a91ca8bbb452a432670b19

SHA256
973bc481f3593ab5f430365796bcf771da68041737a4095c44d302d6f8809c8f

SHA512
f0129996896184ca359ff307b7cbcb5261431900b90a85a75fa478f659a7d04c580410ce098653e6d9c9e8be7640e3b560afc733e7816adcf57fab7ac3a93d16

Download Submit
C:\Users\Admin\Favorites\Microsoft Websites\NwdG4iYr_readme_.txt

Filesize
3KB

MD5
2b3f77fc13ae009410d52adf930cab9c

SHA1
de377f57170cc035d11ff9e3cd4121df7d4322eb

SHA256
f6d6d8a31432f1e8cb03ec589562d02af1fa4df6c36f06df27820175682a8407

SHA512
adf304579926e8c96045b1f8a63316c86456bd0b8007dc72c951dbbf77b2e96ca5fb3524b07710c330f181749f9448e08cff36457d5349c3cee75a9d629773c6

Download Submit
C:\Users\Public\Music\Sample Music\NwdG4iYr_readme_.txt

Filesize
3KB

MD5
16ec166b80da1751e43ced8ae3d1e912

SHA1
80b1f7a348d130bcb694e122012edc7ec769eb5c

SHA256
6639717a5fe746460622d4c459835b96dcd02ffd8289313e4be2a24c272c0031

SHA512
80eef39922b9e9912a894ed5b31db6c5d1599e6701b729c0f2459dbe754c67b41258781a7458495245ec7aa92716177a16cf3148bf84d4a39599a0556dd2f01e

Download Submit