Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 04:10
Behavioral task
behavioral1
Sample
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe
Resource
win10v2004-20240226-en
General
-
Target
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe
-
Size
153KB
-
MD5
35560fff8fc990948a9252bf20cfc8f5
-
SHA1
66163cb283c8792ac32c0e2361adc7143d8d319d
-
SHA256
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1
-
SHA512
9bf7b5aeec71b74012fa36d2af4dc4704e859a564cfbf3b35e44b1af8195a9885292c22a9297b691903c3245a6fae85746590988706e6a4d5dab29937ac13d77
-
SSDEEP
3072:j6glyuxE4GsUPnliByocWepvdHFdjFpZ/fgyVF0djk:j6gDBGpvEByocWetdHZ/fgKF0
Malware Config
Extracted
C:\cHpfiXA9s.README.txt
Signatures
-
Renames multiple (9338) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
8353.tmppid process 704 8353.tmp -
Executes dropped EXE 1 IoCs
Processes:
8353.tmppid process 704 8353.tmp -
Loads dropped DLL 1 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exepid process 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 3 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1650401615-1019878084-3673944445-1000\desktop.ini 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cHpfiXA9s.bmp" 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cHpfiXA9s.bmp" 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe8353.tmppid process 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 704 8353.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHLTS.DAT.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\cHpfiXA9s.README.txt 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\http.luac 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor_1.0.300.v20131211-1531.jar 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Grand_Turk.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana\TAB_ON.GIF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21505_.GIF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296277.WMF.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.hyp.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Beulah.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR31F.GIF.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01785_.WMF.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcc_plugin.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Moscow 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.XML 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.png 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB7.BDR 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PAPERS.INI 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00257_.WMF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\clock.html 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152430.WMF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386270.JPG 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00232_.WMF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\settings.html 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00454_.WMF.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7FR.LEX.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\GRDEN_01.MID.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\WANS.NET.XML.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\RADIO.JPG 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libx26410b_plugin.dll 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.PPD 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239997.WMF 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Modifies Control Panel 2 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop\WallpaperStyle = "10" 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Control Panel\Desktop 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Modifies registry class 5 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cHpfiXA9s\ = "cHpfiXA9s" 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cHpfiXA9s\DefaultIcon\ = "C:\\ProgramData\\cHpfiXA9s.ico" 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exepid process 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
8353.tmppid process 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp 704 8353.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeDebugPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: 36 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeImpersonatePrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeIncBasePriorityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeIncreaseQuotaPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: 33 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeManageVolumePrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeProfSingleProcessPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeRestorePrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSystemProfilePrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeTakeOwnershipPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeShutdownPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeDebugPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeBackupPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe Token: SeSecurityPrivilege 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe8353.tmpdescription pid process target process PID 2208 wrote to memory of 704 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 8353.tmp PID 2208 wrote to memory of 704 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 8353.tmp PID 2208 wrote to memory of 704 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 8353.tmp PID 2208 wrote to memory of 704 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 8353.tmp PID 2208 wrote to memory of 704 2208 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe 8353.tmp PID 704 wrote to memory of 1960 704 8353.tmp cmd.exe PID 704 wrote to memory of 1960 704 8353.tmp cmd.exe PID 704 wrote to memory of 1960 704 8353.tmp cmd.exe PID 704 wrote to memory of 1960 704 8353.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe"C:\Users\Admin\AppData\Local\Temp\3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\ProgramData\8353.tmp"C:\ProgramData\8353.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8353.tmp >> NUL3⤵PID:1960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD53d45a3d675c22e2cecbc0009d7149401
SHA1a7bbec5d20a853e6ab80f0dd1794efc7815fdaca
SHA25613168b3cf2a382b3f7115787313d800e64933e618cd30eca77b84eb477a580ef
SHA5124927926a153184967633fcde9f4002b2a67326031d91e27eaa1c8223f8a0c9ff9b357d423dabe91d30baff0e3058ada46f87050bcdf2fddfcc6e52046988964b
-
Filesize
14KB
MD5808afa42f285dcf66cfd572405a9b4e6
SHA1a554caa2abb014e8e6c0855eb8b1d87cd066ccfc
SHA256241a17958f0bf3ed293bd7395aab74f4e27e0c4cd1a61698941d9239dbefe0cd
SHA51280f63b55eea9565b4e3fdeb83e4c4a4d38ded7331abc9b76c24f072b83c493e41b8d6245f2e5e9930422501ce815c277b8f15454bd8a8a91ef94b019557de474
-
C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Filesize153KB
MD542170eb01a5d68c5e8ffcdb296aec666
SHA1f5c178247c075ba02f519175c58b4439b8b45315
SHA256f79f2a6617fe3965b6292b9620f8b4096d778ae3d3934714e6bba8fc384a1e4c
SHA5127ab108ad7f15a054e93e1509ffea8a1436b3160d3beb383fb79885ccd2d0d343c0ba522a973b66c225d874932145ecc6c6696900e9d30bb37172467b3f5b8132
-
Filesize
1KB
MD53605fdc69caa6b331eaf96ea07e4157d
SHA1fc6bce8fc36aa774fb5e02cc1b25df8b59c6fa44
SHA2560ec8c3830d53015c531dd0d8c540bc961f67888bb44731f87af6ba8be1268df3
SHA5128b3eddd76b231bf1cca7e26d83756d418fab432afb6c7fc46e3e1356c8a580b78e09f29ef3adbadf72a8258c29d4855dac9b4b5c4519535b93a982469519c226
-
Filesize
129B
MD596649f8b0d95fb03ffad76ef4a515618
SHA128ac81089b41eefeda7da0b69a89c34d934bb676
SHA2567c2219d049eeb477356a4df38110552dce1bb39d26176f132ab01ca70b67e871
SHA51279c87da0340266dabd1dca6b84bcc717d999531921873923a3d7adf3522f03aee9deb8fd9aae8610124a92390910312050a9d3c84888fbd46c12931d62b42138
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf