Analysis
-
max time kernel
154s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-03-2024 16:53
Static task
static1
Behavioral task
behavioral1
Sample
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe
Resource
win11-20240221-en
General
-
Target
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe
-
Size
338KB
-
MD5
6d94d664f9ba75013dddf5cefbc9a4f5
-
SHA1
a9c58e2be33854f91cb6eb19701b71b2ad0c8db0
-
SHA256
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716
-
SHA512
a8f8f4985a9fbaaddde72c2a700f11af12232dd2846eeba0f9c7988842bf51154d65c0126d85d610cd321cf6ae04d4dd32e578f54461e04401a44c48ed393846
-
SSDEEP
3072:m/1uwdeUo9srEwzwl6XH4qopEhNJJHpTazxQQ9X4V0vIrFCZezRothGwUy8hv857:8eLLXl6VoyhNbSxQQpHQrqRfqv8+N
Malware Config
Extracted
C:\2uaphKeDl.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (129) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
67F1.tmppid process 3592 67F1.tmp -
Executes dropped EXE 1 IoCs
Processes:
67F1.tmppid process 3592 67F1.tmp -
Drops desktop.ini file(s) 2 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2930051783-2551506282-3430162621-1000\desktop.ini a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2930051783-2551506282-3430162621-1000\desktop.ini a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\2uaphKeDl.bmp" a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\2uaphKeDl.bmp" a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe67F1.tmppid process 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1448 1012 WerFault.exe a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe -
Modifies Control Panel 2 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Set value (str) \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop\WallpaperStyle = "10" a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe -
Modifies registry class 6 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exeMiniSearchHost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2uaphKeDl a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\2uaphKeDl\DefaultIcon\ = "C:\\ProgramData\\2uaphKeDl.ico" a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Key created \REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.2uaphKeDl a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.2uaphKeDl\ = "2uaphKeDl" a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\2uaphKeDl\DefaultIcon a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exepid process 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
67F1.tmppid process 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp 3592 67F1.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeDebugPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: 36 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeImpersonatePrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeIncBasePriorityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeIncreaseQuotaPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: 33 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeManageVolumePrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeProfSingleProcessPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeRestorePrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSystemProfilePrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeTakeOwnershipPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeShutdownPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeDebugPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeBackupPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe Token: SeSecurityPrivilege 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MiniSearchHost.exepid process 1168 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe67F1.tmpdescription pid process target process PID 1012 wrote to memory of 3592 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 67F1.tmp PID 1012 wrote to memory of 3592 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 67F1.tmp PID 1012 wrote to memory of 3592 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 67F1.tmp PID 1012 wrote to memory of 3592 1012 a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe 67F1.tmp PID 3592 wrote to memory of 1988 3592 67F1.tmp cmd.exe PID 3592 wrote to memory of 1988 3592 67F1.tmp cmd.exe PID 3592 wrote to memory of 1988 3592 67F1.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe"C:\Users\Admin\AppData\Local\Temp\a88e9c57e89817701d2651b556f76641e10a7fb54eb29cf9a466648b25fe6716.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\ProgramData\67F1.tmp"C:\ProgramData\67F1.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\67F1.tmp >> NUL3⤵PID:1988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 11762⤵
- Program crash
PID:1448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1012 -ip 10121⤵PID:2748
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55f1e6c660e063c9037f81f8ae01b7570
SHA1bb140448955d2e550705c1afe0863712834eed91
SHA256656d69b223ee714e230b4fc188d91fa6cc1a6332079068f953f427eb04a39203
SHA512ca100a4080c2b54cbf3a10dfb6f5715712864b4659c7f2a22a0d56d4ea17e08edeeab1c120c4cabc1ea5f7e58d905246953036f925be6ad964c71ce01f329083
-
Filesize
10KB
MD5ba95f3178cf34e43e47bf6f1db607ea9
SHA16e465899a852449003e0b40439cd52011b542728
SHA256c33955f3e57eb3b0adeb6b08df0e0c9de2ef111eb8e9ea8cb2daf7f83fda6f50
SHA512075f1773ee259fd16176d8913e877b04f244a3f6d41aab17764f125194c3101c5f2d120e1e7e84c4f26ce80112543fae65ebfee80706c51fbd3413885f5a8d65
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5eebfb84605e05222e3ad98f4b9f62db2
SHA136ddd440df5b2776281ad245a6a57e7a183c09a0
SHA2564a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559
SHA51290e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5405fc71d90ddaa1a11a46a82f45ec8a3
SHA1145d5254a4838d1a93869d23586b9d13362d0895
SHA2560ea7613fb69bc81d4d2f515d22ac9b132e0a82c227785d225bb2eee0f147fc9d
SHA51239803466888e1a00257a17dd9651c3c3b8035dda76f3c86d59a83045be87a210f88538c815d2a0076444eaac6140f9e5d5bd133a6a1150abee9907320e78e8fa
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize338KB
MD5ed5bbf6fb7d5247568bd1bfd0098d501
SHA10828d8e684353c67782a8f2ff5b494b002c5aec1
SHA256cac9025a6aa4b2f18c270b085e82e96432625af29e1fb39fb775b03565824195
SHA512a973e6ee0bf6b6f7b33ecb4d453e280bde70ee05d5a4727757ca725d91d4f1ae3331ec381f18e1af8ba7703310b63a9b91f73eb08212efccb4b004f53cf5392d
-
Filesize
129B
MD5063a67a9f33fd6dcf7e0e9f4082c1d97
SHA1290906e4fdf7fe1ad1f1836b5e9453c2553c1c7d
SHA256089f747b44edce95a588135b3a2b3449f2df9cbc19c43d5727e7085b6cfc35a6
SHA512591c17e00beed226e68b1e8c25eee6de5b2c46f08f62e43158e0931d95f6696973bfe3b824fc4065b784269cfd872a0ffb9b451fe633a9f124f11db3b97a6cbb