Analysis
-
max time kernel
159s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 07:43
General
-
Target
cb673d417b2f650cafee53c2dab9552b482b9c20054977d0444f427567cbd585.exe
-
Size
146KB
-
MD5
753fb0a684edf1cfacd99e3ce8bd08c0
-
SHA1
febb4394e71f9ac92c351599ced9614780d95cde
-
SHA256
cb673d417b2f650cafee53c2dab9552b482b9c20054977d0444f427567cbd585
-
SHA512
d789f940af8acdb23de4192cbdfbc0f3ce1c335ca49539251826c211cd09ac79c445fae0c8f524b6c3fa90d5c392bc1b053a23caaf090eea0460397fd589e387
-
SSDEEP
1536:7zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDv77erNHjqXKCkqEZYqI3AJ5cWs:EqJogYkcSNm9V7Dj8HjqV2QmnOHRT
Malware Config
Signatures
-
Renames multiple (594) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb673d417b2f650cafee53c2dab9552b482b9c20054977d0444f427567cbd585.exe"C:\Users\Admin\AppData\Local\Temp\cb673d417b2f650cafee53c2dab9552b482b9c20054977d0444f427567cbd585.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
-
-
C:\ProgramData\BB0A.tmp"C:\ProgramData\BB0A.tmp"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\BB0A.tmp >> NUL3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{DBD3B7F1-5062-42FF-9BCD-EC5BD005C11E}.xps" 1333923692297100002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
129B
MD51658c25a454c82a4ef41fd693fd96070
SHA1b5b031f013f7b7e2da6835c803b6079a76be53a3
SHA256531474ab4a51d3360aaaeeb8f4e0bdc5a0badeaca2a05941846963fdfa1b456c
SHA5120c68af12950f88032cb1c64ff689253ea45729821fe82a26911b7a5705c94adc9c48ed34a5d27017906474651ff3daf9c5b654df185960beca959213d39b67c3
-
Filesize
479B
MD59116dc4539fb1c5381cf7d6eb16015ef
SHA13aba0eef1367dc3a5abc5281fb041c8d2a3c9769
SHA256c66eaf14c59ba5250def3621f4fd76a95a9da4a2c8c76647f12f2791748cad24
SHA5120912c3138fd78e2a891713ec9fa91c5cb63b0c347ab5e9b9d120b824f2eadb5155ef9dcee8af909c2ed29bb30fdababa902c9e1f0bcca680be97643bc628c503
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD546a87f819d7520ace2b3ccf347c1b67b
SHA1a663b41194246a30378425583318309dd0b2e75e
SHA256660865ee248588c5891815cb9646060575cbcec7d8d3512376137399ca1fa1b7
SHA51284938e107914b9530160bed3bde0c15834da01f6a9b77cb70d0f472fa2c940f5040af7eb37092a4ae6bd018478f9a932e9c31a907c299d438c2d6decda0f1e74
-
Filesize
129B
MD5770bea5e8038f5d10d6d3216cc51de51
SHA16a4f9520c02fa2f7457f2aa35afcdfc49ec1fc01
SHA256afc9e353f6e1b6b716dbc19c22b0c2c7a935e77623e13b3d05f418779e0018bb
SHA512a73aa8bb59006a86162f78a1d59e6a07526ff442440b5ad9145ad62d8428591fa82eaa7d707059e7736314d822d70fbf8e836e4eb62a0d99539d6f323511da82
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB