Analysis
-
max time kernel
296s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
15-02-2024 06:53
Static task
static1
Behavioral task
behavioral1
Sample
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe
Resource
win10v2004-20231222-en
General
-
Target
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe
-
Size
862KB
-
MD5
af9ff037caca1f316e7d05db86dbd882
-
SHA1
844e9b219aaecb26de4994a259f822500fb75ae1
-
SHA256
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae
-
SHA512
e3cc5ca9fa5c4f23dd97389f86af276798ae4db4a68d38812fce25549e7f18e41d2bfc9fa72d3110a54ac88038cb27d3210bd099c6c3975befe5b36a569cd494
-
SSDEEP
24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q1F:dAfSrWW4g+7Ht+UmxJeW
Malware Config
Extracted
C:\Program Files\dotnet\Restore-My-Files.txt
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
https://bigblog.at
http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion
http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion
https://decoding.at
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{B0B063EF-C0C0-8D57-5D4C-5D3FEB3D0F0} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe\"" f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exedescription ioc Process File opened (read-only) \??\F: f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe -
Drops file in System32 directory 1 IoCs
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exedescription ioc Process File created C:\windows\SysWOW64\F4B0B5.ico f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exepid Process 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe -
Drops file in Program Files directory 64 IoCs
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exedescription ioc Process File opened for modification C:\program files\windows defender\fr-fr\protectionmanagement_uninstall.mfl f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\buildinfo.xml f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.office.onenote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\onenotepagelargetile.scale-400.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\app\dev\nls\it-it\Restore-My-Files.txt f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\licenses16\standardvl_kms_client-ul-oob.xrm-ms f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\office16\sdxs\fa000000027\assets\icons\cancelglyph.16.grayf.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.office.onenote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\onenotemediumtile.scale-125.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowsalarms_10.1906.2182.0_x64__8wekyb3d8bbwe\assets\alarmsapplist.targetsize-48_altform-unplated.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.xbox.tcui_1.23.28002.0_neutral_~_8wekyb3d8bbwe\appxmetadata\appxbundlemanifest.xml f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\ui-strings.js f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\emptysearch.scale-125.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowssoundrecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\appxmetadata\appxbundlemanifest.xml f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\app-center\js\nls\eu-es\ui-strings.js f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\exportpdfupsell-app\js\Restore-My-Files.txt f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\pages-app\images\themes\dark\Restore-My-Files.txt f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\windowspowershell\modules\pester\3.4.0\functions\testdrive.ps1 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\vfs\common appdata\microsoft help\ms.spreadsheetcompare.16.1033.hxn f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.desktopappinstaller_1.0.30251.0_x64__8wekyb3d8bbwe\assets\contrast-white\apppackageapplist.targetsize-256_altform-unplated_contrast-white.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.wallet_2.4.18324.0_x64__8wekyb3d8bbwe\microsoft.pay.background.winmd f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\hxmailsplashlogo.scale-100.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.yourphone_0.19051.7.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-white\mediumtile.scale-200_contrast-white.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\my-files\js\nls\ro-ro\ui-strings.js f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectpro2019vl_kms_client_ae-ul.xrm-ms f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowsmaps_5.1906.1972.0_x64__8wekyb3d8bbwe\assets\secondarytiles\directions\home\rtl\contrast-white\medtile.scale-200.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.yourphone_0.19051.7.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-white\appicon.targetsize-40_altform-unplated_contrast-white.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\java\jre-1.8\lib\deploy\messages_zh_tw.properties f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.office.onenote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\onenotenotebooklargetile.scale-200.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.skypeapp_14.53.77.0_x64__kzf8qxf38zg5c\reactassets\assets\rnapp\app\uwp\images\onboarding\notifications_emptystate_v3.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File created C:\program files\windowsapps\microsoft.webmediaextensions_1.0.20875.0_x64__8wekyb3d8bbwe\Restore-My-Files.txt f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.bingweather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\apptiles\contrast-white\weather_tilesmallsquare.scale-100.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.bingweather_4.25.20211.0_x64__8wekyb3d8bbwe\assets\apptiles\weatherimages\210x173\30.jpg f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.mixedreality.portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\appxblockmap.xml f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.mixedreality.portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\assets\mixedrealityportalapplist.targetsize-30_altform-lightunplated.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.webpimageextension_1.0.22753.0_x64__8wekyb3d8bbwe\assets\contrast-black\applist.targetsize-80_altform-unplated_contrast-black.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\outlookmailbadge.scale-150.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\s_download_pdf_18.svg f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\deletedalluserpackages\microsoft.windowssoundrecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\voicerecorderlargetile.contrast-white_scale-125.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowsmaps_5.1906.1972.0_x64__8wekyb3d8bbwe\assets\secondarytiles\directions\work\ltr\contrast-white\smalltile.scale-200.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowssoundrecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\assets\voicerecorderapplist.contrast-white_targetsize-32.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windows.photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\assets\photosapplist.contrast-black_targetsize-80.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowscalculator_10.1906.55.0_x64__8wekyb3d8bbwe\assets\calculatorapplist.targetsize-96_altform-fullcolor.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\genericmailwidetile.scale-100.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowsmaps_5.1906.1972.0_x64__8wekyb3d8bbwe\assets\images\printandshare\glyph_0xe7d5.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File created C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\app-center\js\nls\nl-nl\Restore-My-Files.txt f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\office16\graph.exe.manifest f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.office.onenote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\onenotewidetile.scale-150.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\windowspowershell\modules\pester\3.4.0\functions\pesterstate.tests.ps1 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.webpimageextension_1.0.22753.0_x64__8wekyb3d8bbwe\assets\contrast-white\applist.targetsize-80_contrast-white.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\office16\lpklegal.txt f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowsalarms_10.1906.2182.0_x64__8wekyb3d8bbwe\assets\alarmsapplist.contrast-black_targetsize-80_altform-unplated.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.heifimageextension_1.0.22742.0_x64__8wekyb3d8bbwe\assets\contrast-black\largetile.scale-150_contrast-black.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\fetchingmail-dark.scale-100.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowsmaps_5.1906.1972.0_x64__8wekyb3d8bbwe\assets\apptiles\contrast-white\mapssmalltile.scale-200.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\on-boarding\images\themeless\welcome-2x.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\office16\borders\msart9.bdr f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\deletedalluserpackages\microsoft.zunevideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\assets\contrast-black\widelogo.scale-125_contrast-black.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.bingweather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\assets\apptiles\weather_tilelargesquare.scale-100.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.webmediaextensions_1.0.20875.0_x64__8wekyb3d8bbwe\assets\contrast-black\applist.targetsize-80_altform-unplated_contrast-black.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowsstore_11910.1002.5.0_x64__8wekyb3d8bbwe\microsoft.ui.xaml\assets\noiseasset_256x256_png.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\images\themes\dark\s_reject_18.svg f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\licenses16\visiopro2019r_trial-ppd.xrm-ms f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\windowsapps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\hxcalendarapplist.targetsize-256_altform-lightunplated.png f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe File opened for modification C:\program files\microsoft office\root\licenses16\projectpror_retail2-ul-oob.xrm-ms f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exedescription ioc Process Key created \Registry\Machine\Software\Classes\.lockbit f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe Key created \Registry\Machine\Software\Classes\.lockbit\DefaultIcon f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lockbit\DefaultIcon\ = "C:\\windows\\SysWow64\\F4B0B5.ico" f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exepid Process 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exedescription pid Process Token: SeTakeOwnershipPrivilege 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe Token: SeDebugPrivilege 1500 f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe"C:\Users\Admin\AppData\Local\Temp\f3e891a2a39dd948cd85e1c8335a83e640d0987dbd48c16001a02f6b7c1733ae.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5b37755c8e288ebf7dfccc2c26c0b8a11
SHA1d7683947c69cb529a21b9459ed3d38dfe02edbd0
SHA2566311ee66cf42076949ba18a483abb8f9e3bc2f4cbc54e39b9c28467a693dd411
SHA5125df33900d7361bd78d3d58dd3f568ff9f87e634fe6e4ef5afbecc0a5708be4ded0f3252c621003db8f57c09cbb6ea095cad956ab90963f3d14f3be2196ac0701