Resubmissions
26/02/2025, 16:43
250226-t8l7aawtcw 10Analysis
-
max time kernel
89s -
max time network
72s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
26/02/2025, 16:43
Behavioral task
behavioral1
Sample
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
600 seconds
Behavioral task
behavioral2
Sample
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
12 signatures
600 seconds
General
-
Target
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
-
Size
483KB
-
MD5
53717dc73f61b0f9551cb62d6fca2e4a
-
SHA1
1ca9304e86632b147852767c85c57e08bdfc8855
-
SHA256
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028
-
SHA512
ae6ff8377d89cd3d1686c5a6bd7bb398bb975e4e52f7db5fbb0550783d77648558f03a13a9751d0cb6ed993621b12980d54777385802dd4c014ec22ae8d33552
-
SSDEEP
12288:WcvbX8rMmSZJ8t9ZITyDpFGIOyA4muT5WFExk8y:/zMr1SZJ8t9ZITyNzOt4dVy
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\FbRCD_readme_.txt
Family
avaddon
Ransom Note
-------=== Your network has been infected! ===-------
***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED *****************
All your documents, photos, databases and other important files have been encrypted and have the extension: .BbEdCcBbEd
You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files!
The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files!
We have also downloaded a lot of private data from your network.
If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info.
You can get more information on our page, which is located in a Tor hidden network.
How to get to our page
--------------------------------------------------------------------------------
|
| 1. Download Tor browser - https://www.torproject.org/
|
| 2. Install Tor browser
|
| 3. Open link in Tor browser - avaddonbotrxmuyl.onion
|
| 4. Follow the instructions on this page
|
--------------------------------------------------------------------------------
Your ID:
--------------------------------------------------------------------------------
MTgwNS1veHc0elRGcFZ5cHhlQzc5S1BEN0lhS1VuM1JQZkU5L2ZLVDlqam8zeDl5dXdhL1p2MXFodGFSMlE3TVRoVWUxVWV1U3pFYWEyWTJMMWc3cndnSGhlLzRiMlkwM1ViRC9CVUd3RDVIRTE0NzlSZVh5cEhSdXI2alFsaUViMmJLZ3d4dWNncmpMRlV2MVBhUXdwd0cyeTNCbGtlVEZDcnJtWkk1RGVrMVJFWmtMdVNRaktmQ3RDYWVFTGZCV1ErakRKZE4rYkVERUpRL01MSEJ1Z3BkbTZXRXcvcThTSTA2SndUeHdZazRQZWxrVjlNVjArVnZoRlU1TGVhaDZueUp5d21BSVE2R1VvNG1tVjdXSjMra1l1aWVuQ2RUekVFRVI5a3V1L2hVb0M0by9Yd0tvTFVPZXpyQldHU0h1c0FrVXY0MlUzbnBQdmZteElZNEVVeDM0WkxIU2VETCtseWI2bCsxOXBBNUw5ZFJ6YjNlOWlmc0dTT3lzc2VMZ0Fnamp0cWpBM245Z1JHV2tuMnE1OHRoTHI5eTN5VnRRMzduTVFka3MvY2c1THo3Y2lYOW1yb2RWZkd6clRaNVlVN3BObTdMUjVsOFlNS2ZlVUpieWMrZ0FHeStvNlFLR2JQRXRtbHMyT2tuM3JMdHREV1NSTDV6SDRHNnIxbWNxZEJUelNBWTVtUm5oM3N4VDVmZ1Y2UXdUNVRWeEcxZ2JHcURWQWRoYlFvSnpjRkhadUFJMWU1aG1qT0pUZGhWN09ZdjZYbTliTUFPY1gyLzBudkp1UklNWjNHUmZMeWZQWUpPbmtybEsyMVl3azByMEtrbUVBcVEzeXVVaHZoUHgxZGIwOXcyVTJENzBkSTRjYlE1M3ZiYTREMnJVejJmTTBodGpoNmZBNGZXNEZDSFZlSkNpeW5ScjlzVFhDSlRIYXQ3b0J3Z1JqeDNVUEE4c3JPbUxrcURnMEJsdkN0SjZ6RWFaMmd6UldKQ3hsazhxY0FHbmR1Z25UN203S2c2VlN4SnpJbzVGby9RcnhELzR4cmQyN1FMY1VSaVFuRUhveFhXMlNxQjd6ZUx5K2ZFbzVhbU9HNzArV2hNZUZHSjRCdW9kRXRtRHU3b1lCUjk0cXZIQnFveUlraFhQOWUvZEMzVjh4NmNYSklDakg5NTRUdmNjaUJmalB3dlBXM2NoZ2FYWEV2RnpkQWRQdmN0dlhySG9GMlprYTRNK2N3VkpGZVBoakxqWDZTRDJxV1FKR0YwTjJzcG52QkJNL1Y5QnNvMXQ2SHVDdjJJci9OeWdlUzI2MnVtK2cyN0dINUUyOFRiL1N4Y1NSOVZIZ1ZBdGxEbnRYdVFKMnVQMk9GeERycGpJblFmVkVsZHlvNU9QMmF5RFFBdzJRMGlBQlF2UTVJbmlhYklxdGFGZ3F0NlhZZk5hUEw5a3hCWGNhRWRGZnVNczJydjV6WEVwbWIrSERZdCtkNVF2Q0lpZzRGM0h2T3R2QjJUSzFZWG4yRXVsZldxNERndVZsdUUzNzYyMzRiaDRsZkt3VUFGd2RaZWJob3JRMjJHK0Vmcnpxc0diV3R5ZTdhMFlrQ2pSYjlvemFRUFNYQ05jR3d3dFRla3pRK0QyVFFlTm8rNVV0Ym50NnVhbEQwRVo0MC8zVkZlOFhOYzR0dk4wVFowZ2JUa3JMY0NxMnVYbEtKeG1LQm5PeUthQUlIZ1N3MmF4T1NHd05SWGZkeVc1cWRzMWZBZnhiV0JETGdwbEVNdXFROXVsMUExTVJtblNpN2pjRWRDaFNwdDJjRzhrZDhabXRLL0NjNXc2UVFEblNhdUdzTWF0eGFXUDY5RFAxRDlMZHVDdFZEL1RVelJvcEh1dXhralo2ZzZjbXV3UGtTcDBRNkR5ZmZLS3hSdGk1R3VoUHNkQ3JpbEluMnYyVENKbUxJY3JnTG9kaWo2MWdSOGQzeTdSS2Nkb252NEx3Q05vOFpNWGVvc000bkJISytWSGYwa2Rmc3pGVzJPRnkveWVlelJPVVVtd00xWkhYZEQ3OTIvTU1vclUxQ0hxOHcwbXZBODFjUGs3NVVGVEhKSWk3S3lZeW9iV0VEZzRKdThBVnRSYk05dFRkRUpwMzBYZ0NsaTBRcE9uTkF6eXBKMjRIalcxZzh6SUdyNDNtUT09
--------------------------------------------------------------------------------
* DO NOT TRY TO RECOVER FILES YOURSELF!
* DO NOT MODIFY ENCRYPTED FILES!
* * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * *
5
URLs
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Signatures
-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (146) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\Y: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\A: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\E: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\L: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\R: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\S: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\F: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\H: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\I: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\J: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\V: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\K: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\N: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\O: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\Q: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\W: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\X: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\Z: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\B: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\G: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\M: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\P: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe File opened (read-only) \??\T: c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 4076 NOTEPAD.EXE 388 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1496 wmic.exe Token: SeSecurityPrivilege 1496 wmic.exe Token: SeTakeOwnershipPrivilege 1496 wmic.exe Token: SeLoadDriverPrivilege 1496 wmic.exe Token: SeSystemProfilePrivilege 1496 wmic.exe Token: SeSystemtimePrivilege 1496 wmic.exe Token: SeProfSingleProcessPrivilege 1496 wmic.exe Token: SeIncBasePriorityPrivilege 1496 wmic.exe Token: SeCreatePagefilePrivilege 1496 wmic.exe Token: SeBackupPrivilege 1496 wmic.exe Token: SeRestorePrivilege 1496 wmic.exe Token: SeShutdownPrivilege 1496 wmic.exe Token: SeDebugPrivilege 1496 wmic.exe Token: SeSystemEnvironmentPrivilege 1496 wmic.exe Token: SeRemoteShutdownPrivilege 1496 wmic.exe Token: SeUndockPrivilege 1496 wmic.exe Token: SeManageVolumePrivilege 1496 wmic.exe Token: 33 1496 wmic.exe Token: 34 1496 wmic.exe Token: 35 1496 wmic.exe Token: 36 1496 wmic.exe Token: SeIncreaseQuotaPrivilege 1496 wmic.exe Token: SeSecurityPrivilege 1496 wmic.exe Token: SeTakeOwnershipPrivilege 1496 wmic.exe Token: SeLoadDriverPrivilege 1496 wmic.exe Token: SeSystemProfilePrivilege 1496 wmic.exe Token: SeSystemtimePrivilege 1496 wmic.exe Token: SeProfSingleProcessPrivilege 1496 wmic.exe Token: SeIncBasePriorityPrivilege 1496 wmic.exe Token: SeCreatePagefilePrivilege 1496 wmic.exe Token: SeBackupPrivilege 1496 wmic.exe Token: SeRestorePrivilege 1496 wmic.exe Token: SeShutdownPrivilege 1496 wmic.exe Token: SeDebugPrivilege 1496 wmic.exe Token: SeSystemEnvironmentPrivilege 1496 wmic.exe Token: SeRemoteShutdownPrivilege 1496 wmic.exe Token: SeUndockPrivilege 1496 wmic.exe Token: SeManageVolumePrivilege 1496 wmic.exe Token: 33 1496 wmic.exe Token: 34 1496 wmic.exe Token: 35 1496 wmic.exe Token: 36 1496 wmic.exe Token: SeBackupPrivilege 5064 vssvc.exe Token: SeRestorePrivilege 5064 vssvc.exe Token: SeAuditPrivilege 5064 vssvc.exe Token: SeIncreaseQuotaPrivilege 412 wmic.exe Token: SeSecurityPrivilege 412 wmic.exe Token: SeTakeOwnershipPrivilege 412 wmic.exe Token: SeLoadDriverPrivilege 412 wmic.exe Token: SeSystemProfilePrivilege 412 wmic.exe Token: SeSystemtimePrivilege 412 wmic.exe Token: SeProfSingleProcessPrivilege 412 wmic.exe Token: SeIncBasePriorityPrivilege 412 wmic.exe Token: SeCreatePagefilePrivilege 412 wmic.exe Token: SeBackupPrivilege 412 wmic.exe Token: SeRestorePrivilege 412 wmic.exe Token: SeShutdownPrivilege 412 wmic.exe Token: SeDebugPrivilege 412 wmic.exe Token: SeSystemEnvironmentPrivilege 412 wmic.exe Token: SeRemoteShutdownPrivilege 412 wmic.exe Token: SeUndockPrivilege 412 wmic.exe Token: SeManageVolumePrivilege 412 wmic.exe Token: 33 412 wmic.exe Token: 34 412 wmic.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2176 wrote to memory of 1496 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 85 PID 2176 wrote to memory of 1496 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 85 PID 2176 wrote to memory of 1496 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 85 PID 2176 wrote to memory of 412 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 90 PID 2176 wrote to memory of 412 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 90 PID 2176 wrote to memory of 412 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 90 PID 2176 wrote to memory of 4028 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 92 PID 2176 wrote to memory of 4028 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 92 PID 2176 wrote to memory of 4028 2176 c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe 92 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe"C:\Users\Admin\AppData\Local\Temp\c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic SHADOWCOPY DELETE /nointeractive2⤵
- System Location Discovery: System Language Discovery
PID:4028
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FbRCD_readme_.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4076
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WriteConvertTo.snd.txt1⤵
- Opens file in notepad (likely ransom note)
PID:388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5366a94185a78b2adb195c877e942dc8c
SHA187e7dd005dc1d7af45751a009fbc349ac28a93f7
SHA25642a26c9e90c9d7d0548094255dad2d950e360d9deb6be72146d131a7ad306eea
SHA5121d7da7e684769ba8bdd79fe4a80d7cb8c54fd04ed344e4fe597caa7eb1ed843a2745b4019192a8f45d759c3b6e36ee4ee2213d91b63f60ada3a510e4de47208f
-
Filesize
896KB
MD57b4884cd4d4453652ea4c8f625368f11
SHA1aaece200310760bd7a03bf07a0a60749153b9784
SHA2568ec3a253fdf1eb1f09938bac7b6206f27f3720d7fafc68e118b233696504cf8c
SHA512f2687cdce08a3ebfa64219983256e75a87786be5bcca6cc6023be2ecfa0d6cbf7abdc968c0bdd913fceff32c0977c8e34d84ae03610f5599cf7a9a35a4e7add9