Analysis
-
max time kernel
365s -
max time network
360s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15-02-2024 08:06
Behavioral task
behavioral1
Sample
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe
Resource
win10v2004-20231215-en
General
-
Target
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe
-
Size
159KB
-
MD5
5e54923e6dc9508ae25fb6148d5b2e55
-
SHA1
97bef2aed306a8f6bde427fd22e0f20095f14af7
-
SHA256
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9
-
SHA512
a8195321328c3beeae525ecedb672c520f15f2053eb39aa94efb123506741b807b666d8e15bf2c2c30fbafe9b6df8fc76a10897b3dff889683506d836b42a621
-
SSDEEP
3072:auJ9OlKolUa1U197bzhVsmftsXTUgbQ8aXqgP:aufj0zi1dNVsmftYT+5qE
Malware Config
Extracted
C:\Users\47IsP2Rni.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
34C6.tmppid Process 1824 34C6.tmp -
Executes dropped EXE 1 IoCs
Processes:
34C6.tmppid Process 1824 34C6.tmp -
Loads dropped DLL 1 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exepid Process 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3818056530-936619650-3554021955-1000\desktop.ini 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3818056530-936619650-3554021955-1000\desktop.ini 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\47IsP2Rni.bmp" 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\47IsP2Rni.bmp" 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe34C6.tmppid Process 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp -
Modifies Control Panel 2 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop\WallpaperStyle = "10" 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe -
Modifies registry class 5 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\47IsP2Rni\DefaultIcon\ = "C:\\ProgramData\\47IsP2Rni.ico" 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.47IsP2Rni 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.47IsP2Rni\ = "47IsP2Rni" 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\47IsP2Rni\DefaultIcon 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\47IsP2Rni 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exepid Process 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
34C6.tmppid Process 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp 1824 34C6.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeDebugPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: 36 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeImpersonatePrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeIncBasePriorityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeIncreaseQuotaPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: 33 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeManageVolumePrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeProfSingleProcessPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeRestorePrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSystemProfilePrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeTakeOwnershipPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeShutdownPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeDebugPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeBackupPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe Token: SeSecurityPrivilege 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe34C6.tmpdescription pid Process procid_target PID 3008 wrote to memory of 1824 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 30 PID 3008 wrote to memory of 1824 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 30 PID 3008 wrote to memory of 1824 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 30 PID 3008 wrote to memory of 1824 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 30 PID 3008 wrote to memory of 1824 3008 87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe 30 PID 1824 wrote to memory of 1960 1824 34C6.tmp 33 PID 1824 wrote to memory of 1960 1824 34C6.tmp 33 PID 1824 wrote to memory of 1960 1824 34C6.tmp 33 PID 1824 wrote to memory of 1960 1824 34C6.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe"C:\Users\Admin\AppData\Local\Temp\87b76f35740262abb8da224b94779ff56eb6346318b4f9fb1988a59a72a4e6c9.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\ProgramData\34C6.tmp"C:\ProgramData\34C6.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\34C6.tmp >> NUL3⤵PID:1960
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1501⤵PID:2524
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD595daa831369bbf496866dff68cfc78cd
SHA1a6d8201e2091b064a2f160942973d5c4a2e1e686
SHA256ddf1ff26a661f0bbacaf5a4d07460ea5627fb8917717dbb9ac3f3a94a6ddec2b
SHA5126bea496e3ae351d2560febc42fd1a0e7d164d8412d5193907f51772aecfa177aa31ea9c3df66c005862f636758587e8c8686c675db5f7d039fcb4f745b5c3aa4
-
Filesize
10KB
MD55e80834a3beac1ac107dd600729634f6
SHA16299398b2012289d48acc49953817a6423af3b0e
SHA256ffd80bf4b264beb9e2caa0ddeacd8f1fd526412c1d86ad3bb4d9d88823578150
SHA5128dbdae7eec3612e454d6c77131269e06cc2b34fd16a56f51324f1eb238ac001484245dd435f9f829490e75bb8a23cd567004b9428309242905fd6ca2fea4d99c
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD5d9a77ba2ffbc3d2bddd302add9d43d38
SHA16cba15bca848732ae866daf099f4a77b17f1bab7
SHA256ed2351ec7272cfee5be94db2430a5d3e3feb912455b4aef009e7a561ba0d5b13
SHA51265611f3e0e5b0700dd8c45400df1146d42b79b15be552cdddf8bdffaa78409a6175199ea29a4a4ff822338a24d1010067acc89fea8703c993e15813e5b7adc83
-
Filesize
129B
MD510b7bd29bb92168c80e261e5c9fe2315
SHA1881341cc616951fa7500d0851989bcac1f02b58f
SHA256a844b637f872a6aae81a9e609e2355dc75608ff9df9b211818513180fb547757
SHA512a5dbca364702977f445b18b9906301b8a22c4ac551f40684371a56caebc34aec32dbcd03f01616a1182855d12640a118e9867a5dc2b7ba58165db33facda4a93
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf