Analysis
-
max time kernel
119s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:08
Behavioral task
behavioral1
Sample
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe
Resource
win10v2004-20240226-en
General
-
Target
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe
-
Size
159KB
-
MD5
99bcce4f1d96c6ef25c157c9762d7fba
-
SHA1
85125f8f6ddc5dddca55c3c162eadffc7c10c231
-
SHA256
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
-
SHA512
aa31d760be90faf8c2cad5901cdd7ca609f97d327f1c3660af661a43f77e865f5380fa1743969a10642ac4ba4219244d6890a70b4594ff260b34fb71a3518e47
-
SSDEEP
3072:IuJ9OlKolUa1U197bzhVsmftsZzSY2h1OSzlezR9P32:Iufj0zi1dNVsmfte2Y2hvMX32
Malware Config
Extracted
C:\Users\sdBuuG2px.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
Processes:
366C.tmppid process 2364 366C.tmp -
Executes dropped EXE 1 IoCs
Processes:
366C.tmppid process 2364 366C.tmp -
Loads dropped DLL 1 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exepid process 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\sdBuuG2px.bmp" 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\sdBuuG2px.bmp" 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe366C.tmppid process 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallpaperStyle = "10" 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe -
Modifies registry class 5 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sdBuuG2px 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sdBuuG2px\ = "sdBuuG2px" 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px\DefaultIcon 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\sdBuuG2px\DefaultIcon\ = "C:\\ProgramData\\sdBuuG2px.ico" 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exepid process 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
366C.tmppid process 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp 2364 366C.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeDebugPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: 36 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeImpersonatePrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeIncBasePriorityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeIncreaseQuotaPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: 33 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeManageVolumePrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeProfSingleProcessPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeRestorePrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSystemProfilePrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeTakeOwnershipPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeShutdownPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeDebugPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeBackupPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe Token: SeSecurityPrivilege 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe366C.tmpdescription pid process target process PID 2872 wrote to memory of 2364 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 366C.tmp PID 2872 wrote to memory of 2364 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 366C.tmp PID 2872 wrote to memory of 2364 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 366C.tmp PID 2872 wrote to memory of 2364 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 366C.tmp PID 2872 wrote to memory of 2364 2872 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe 366C.tmp PID 2364 wrote to memory of 1936 2364 366C.tmp cmd.exe PID 2364 wrote to memory of 1936 2364 366C.tmp cmd.exe PID 2364 wrote to memory of 1936 2364 366C.tmp cmd.exe PID 2364 wrote to memory of 1936 2364 366C.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe"C:\Users\Admin\AppData\Local\Temp\2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\ProgramData\366C.tmp"C:\ProgramData\366C.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\366C.tmp >> NUL3⤵PID:1936
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5fa555f3227f58aacf167dfa866125eef
SHA112682ee9b2f8f73bacc882b46476622595a6b9ff
SHA2560f2eb0339afc87aeda971c74b28021605bb56d3ddc8e8141de3c09d083da5fef
SHA512486fbc31ee0ef96d2d9fc258cfeb0dfee45307ddc455a605286191259ab543b15cdd6057cd2e79009f33b45748272cf9455b82d43bb1e98e9a2fb90b3ff30099
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD5117ca621e50e4d3a61be5e2f93d853b9
SHA10c31007fd0ed09a03a7dbcee58bfe10449249deb
SHA256e52400257215aebb924d1d0da2f6cda181bdaabc0e15b05a1f76d41717e5b555
SHA5122d5b49e5b29aa10143183844b3f5e3efa7b3caddf61cab380d84550a28f7a965b06abf62beb15bbe2d0e800751500297c2cbec25b5aa2d027d9cd40e2b149ec2
-
Filesize
10KB
MD5d4cfa0c2eba7e16cd40a9626b97f943a
SHA1653cf80e99cee5a6540dd6009ea72917be80541a
SHA256a495bf2b826491546e2db1a86cb8e06f632efcc330fbc12610d647638dc8357a
SHA512082d45dafabfef829414356bfc57715a840dec860d60f6c021dcdb367c177124a3e63e87c3b6169a813773cbe86e6fa4f0a416114c97ef91fc688611cab6885a
-
Filesize
129B
MD565ec569edb20eced64d370533d15c5ee
SHA16457f7804f71157fca14d7994b2db1ee29479ab4
SHA256edf050b36c2ebfadf03a3d99fff6726867c989d2556f3808ce88271989456d9d
SHA5123e89a5fc9582847798bd6f6fd7cad714740ef73c731c18e47e4c85250105c68870067da3f09701247fc1d64edde3d510d1e88e836a0ed692c2847c4f9730f7bf
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf