Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:08
Behavioral task
behavioral1
Sample
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe
Resource
win10v2004-20240226-en
General
-
Target
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe
-
Size
200KB
-
MD5
da44b75688848eaad3b888d4ffa3eb8a
-
SHA1
1e18f8d613b31426bf7c3cad82ecee94e94f4fdb
-
SHA256
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f
-
SHA512
ee19553d7816dc82dac7dd7bc7e9f05e9360074e7870e032da02f12bc29f2487085bc89aadb8712c687f1f844361eab18c09a92b965eb96c0c14491e630411f2
-
SSDEEP
3072:sr85Cua1U197bzhVsmftsZzSY2h1OSzlezR9P32euJ9OlKolb:k9Ri1dNVsmfte2Y2hvMX32eufj0b
Malware Config
Extracted
C:\Users\sdBuuG2px.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Detect Neshta payload 11 IoCs
Processes:
resource yara_rule C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe family_neshta behavioral1/memory/2224-433-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-434-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-435-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-436-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-439-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-440-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-441-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/2224-443-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta C:\Windows\svchost.com family_neshta behavioral1/memory/1624-454-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\3582-490\286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe family_lockbit -
Executes dropped EXE 3 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe4624.tmpsvchost.compid process 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2744 4624.tmp 1624 svchost.com -
Loads dropped DLL 4 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exepid process 2224 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2224 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2224 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\sdBuuG2px.bmp" 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\sdBuuG2px.bmp" 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe4624.tmppid process 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2744 4624.tmp 2744 4624.tmp 2744 4624.tmp 2744 4624.tmp 2744 4624.tmp 2744 4624.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription ioc process File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Drops file in Windows directory 3 IoCs
Processes:
svchost.com286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription ioc process File opened for modification C:\Windows\directx.sys svchost.com File opened for modification C:\Windows\svchost.com svchost.com File opened for modification C:\Windows\svchost.com 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallpaperStyle = "10" 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Modifies registry class 6 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sdBuuG2px\ = "sdBuuG2px" 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px\DefaultIcon 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px\DefaultIcon\ = "C:\\ProgramData\\sdBuuG2px.ico" 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sdBuuG2px 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exepid process 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeDebugPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: 36 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeImpersonatePrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeIncBasePriorityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeIncreaseQuotaPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: 33 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeManageVolumePrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeProfSingleProcessPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeRestorePrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSystemProfilePrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeTakeOwnershipPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeShutdownPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeDebugPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeBackupPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe Token: SeSecurityPrivilege 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe4624.tmpsvchost.comdescription pid process target process PID 2224 wrote to memory of 2928 2224 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe PID 2224 wrote to memory of 2928 2224 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe PID 2224 wrote to memory of 2928 2224 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe PID 2224 wrote to memory of 2928 2224 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe PID 2928 wrote to memory of 2744 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 4624.tmp PID 2928 wrote to memory of 2744 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 4624.tmp PID 2928 wrote to memory of 2744 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 4624.tmp PID 2928 wrote to memory of 2744 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 4624.tmp PID 2928 wrote to memory of 2744 2928 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe 4624.tmp PID 2744 wrote to memory of 1624 2744 4624.tmp svchost.com PID 2744 wrote to memory of 1624 2744 4624.tmp svchost.com PID 2744 wrote to memory of 1624 2744 4624.tmp svchost.com PID 2744 wrote to memory of 1624 2744 4624.tmp svchost.com PID 1624 wrote to memory of 888 1624 svchost.com cmd.exe PID 1624 wrote to memory of 888 1624 svchost.com cmd.exe PID 1624 wrote to memory of 888 1624 svchost.com cmd.exe PID 1624 wrote to memory of 888 1624 svchost.com cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe"C:\Users\Admin\AppData\Local\Temp\286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3582-490\286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\ProgramData\4624.tmp"C:\ProgramData\4624.tmp"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4624.tmp >> NUL4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C DEL /F /Q C:\PROGRA~3\4624.tmp >> NUL5⤵PID:888
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵PID:912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5aa82718bd630e731e21996feca27c2fe
SHA16108f0cb61c1df30d0cb0cc2ebe2e470f66e3e43
SHA256d599b5f20b6992598cbfc5771a881cc5351e7b3d5ddac61a645f834e737bad98
SHA5127d90dda00d04121f046a6c20c30164545fc18d3d538d99f267cc68711442cabd5d57076752b39fe33733b04a7c3f0408209575f7f3585f576097949a140fc9a7
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
C:\Users\Admin\AppData\Local\Temp\3582-490\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD568782aa209795f91c61271edd92120cd
SHA16a8f3aec6f8eae4da69a905c49998a2b272f1c84
SHA2560cc57d96c53e13fde6cbe05fc38fa436320d41cab10c67b92b9d5db0c18ebef9
SHA512abd14c8201a2e3a06a64ef9d4f64656c8ebd76adafd2c98b78f37741a633287323acce41b11550abbc36cc935fedd69d13ce628cba410d59310124cff4ad0565
-
Filesize
8B
MD5e838aeaec907e4e751d289d0f3885adf
SHA13ed965b4f2656e44e9894d07afe981963c173f24
SHA256dcbe10f5af82bff412cdb24620c0d1ead63ac89c963c0a88ca680d832b448ab8
SHA512fc31e3a679a7f200a834577bb6f288a183b8058810e7a6cd3adde5e8546a5dcdf2408f368861a79d66a4b00f42290ea27de6e20d0dd0692f9176796badacb036
-
Filesize
10KB
MD59257599197e160831a8972821e99946e
SHA1899c5be2eb951591e4cbe93a81066565d77f5117
SHA256992d119c71ecb1609faf224e8ff38fa696a08d58172ab4d04296debce92d3170
SHA5121a8815242f2521973eac113d5e26512f00a27c039ff1a65fcfb6eca6c1b267a4329927bb3fd8b0c0b863dad2d030c53b23ec788fbf21386f1a1268f7ec489d8c
-
Filesize
40KB
MD536fd5e09c417c767a952b4609d73a54b
SHA1299399c5a2403080a5bf67fb46faec210025b36d
SHA256980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA5121813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92
-
Filesize
129B
MD53a7f68f98349a262be09b3a54624f283
SHA1f05bc5a25d2104aa0a89d5fe05e05d4645609a68
SHA256a39dccbb9ed85f7ee6b1ad8d1a637306e06f81f568e1fae6596fe4da39ffce2e
SHA512ff5b712f7f7a241dc9229b5291ba23f3d78c35fd666714791bacaab106c85aebc1c881d0b4338698de8824114729e7dbdd3986748dd5c673be33901db90599ad
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
\Users\Admin\AppData\Local\Temp\3582-490\286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f.exe
Filesize159KB
MD599bcce4f1d96c6ef25c157c9762d7fba
SHA185125f8f6ddc5dddca55c3c162eadffc7c10c231
SHA2562e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
SHA512aa31d760be90faf8c2cad5901cdd7ca609f97d327f1c3660af661a43f77e865f5380fa1743969a10642ac4ba4219244d6890a70b4594ff260b34fb71a3518e47