Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:13
Behavioral task
behavioral1
Sample
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe
Resource
win10v2004-20240226-en
General
-
Target
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe
-
Size
153KB
-
MD5
4bb5628ded1704d96c17559cdd49c738
-
SHA1
ae3df3e10cdcfd03251e9f3bbd5c8d0aef4fa51c
-
SHA256
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1
-
SHA512
6562e2aebb90e70bce168840fa5872017046410a038bdfc642a041adc2f6dd2803a6b6daa46303c4d8b43e5f13599b11d758c21b1c2b3a7bee5deaf93324cddf
-
SSDEEP
3072:06glyuxE4GsUPnliByocWepQst7pospt5mucmG7A:06gDBGpvEByocWeWsFpoybG
Malware Config
Extracted
C:\AKEVizErI.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (571) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6562.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 6562.tmp -
Deletes itself 1 IoCs
Processes:
6562.tmppid process 2712 6562.tmp -
Executes dropped EXE 1 IoCs
Processes:
6562.tmppid process 2712 6562.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPfjw8mr9es379qa6l121l4vcvc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPn9g09fo0lt9r6wys8pjfilk6b.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPturuxaqmm0vqqeavu51yh0ezc.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\AKEVizErI.bmp" 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\AKEVizErI.bmp" 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe6562.tmppid process 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 2712 6562.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallpaperStyle = "10" 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe -
Modifies registry class 5 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AKEVizErI 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AKEVizErI\DefaultIcon\ = "C:\\ProgramData\\AKEVizErI.ico" 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.AKEVizErI 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.AKEVizErI\ = "AKEVizErI" 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AKEVizErI\DefaultIcon 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exepid process 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
6562.tmppid process 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp 2712 6562.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeDebugPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: 36 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeImpersonatePrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeIncBasePriorityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeIncreaseQuotaPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: 33 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeManageVolumePrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeProfSingleProcessPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeRestorePrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSystemProfilePrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeTakeOwnershipPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeShutdownPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeDebugPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeBackupPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe Token: SeSecurityPrivilege 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid process 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE 4080 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exeprintfilterpipelinesvc.exe6562.tmpdescription pid process target process PID 4008 wrote to memory of 2628 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe splwow64.exe PID 4008 wrote to memory of 2628 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe splwow64.exe PID 448 wrote to memory of 4080 448 printfilterpipelinesvc.exe ONENOTE.EXE PID 448 wrote to memory of 4080 448 printfilterpipelinesvc.exe ONENOTE.EXE PID 4008 wrote to memory of 2712 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 6562.tmp PID 4008 wrote to memory of 2712 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 6562.tmp PID 4008 wrote to memory of 2712 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 6562.tmp PID 4008 wrote to memory of 2712 4008 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe 6562.tmp PID 2712 wrote to memory of 1012 2712 6562.tmp cmd.exe PID 2712 wrote to memory of 1012 2712 6562.tmp cmd.exe PID 2712 wrote to memory of 1012 2712 6562.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe"C:\Users\Admin\AppData\Local\Temp\64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2628
-
-
C:\ProgramData\6562.tmp"C:\ProgramData\6562.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6562.tmp >> NUL3⤵PID:1012
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5020
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{8F1BFBED-0409-40E0-BEAF-F2FB2A179882}.xps" 1335486320881700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD54a5c02898f87544e9062f312dce7bb94
SHA1af52d74c943100f7c794bfadc66e5fea41c670ea
SHA2563a39241610fdb035fd8b1d2a671e313a714db15bed05f8ccedd0f39d5809a60b
SHA512733b4e833d0bb70919253cbfd180bc342a133115b3e745b4e227cfa24301040b958dc3b7580f54b3b4fc84e11cc5aa4963fb705e7f8e4124a5b38277cacd55ae
-
Filesize
6KB
MD5c386ad5c1bcefc48977be2389beeed82
SHA17c807b6090782a6a33afd7ebf17ee20c5545680a
SHA25627ee26fb3c243be2f4a132f0479bb1a017f94d582f0a3fcfb8eaa0d3648332f4
SHA5124c0d738108f7809116aabb8c44125f3ee59690fdeb147cdb901ea298535848ef1392827bb0d5cf990701c407a4eb26f59536d68d2cc9c791852dfdcbaec2b3e8
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize153KB
MD5bbae21078190b5bf884fa45a2d2a3bbd
SHA1033fd4f0b1743cccc847a75b17dc6410df9c3127
SHA2568a0412200d725aa5e4983f472fcaf2a80b2b6262e0932b0919a9ee8bcd574e5f
SHA51233ade612f999a4490963979021243e25aaba8dec83c88bfd3e91cfa6ad21d28cf5c4e9962eb79d364d7ce6836a82f16b7dd27b889fb94907029877a4db4d5a92
-
Filesize
4KB
MD5651466011f89ff33664d6d7f01296682
SHA1d69f421dad2e7d02a538881e3425abe76f97c60a
SHA2561b4066c728e583e46f554e1795cce132ba0e378aec5bca79e3fc600a5351165b
SHA5120a296d248496b3a37e93fcf4ceaaf518756fc3e7372169469067d67e31d258ecd399c0a2a1c75cc75417e9427062646e62b4e6abe29470eeb325d01d1a5cb3f3
-
Filesize
129B
MD5d43c516a32a5038e7254b0a8f8e2c89f
SHA124cd5483de714652941dab71f96ac71a613bbb35
SHA256fe318f7dff79357f8767ae7a158b6b78cabe6c0a3c817b9adce313a26d26421a
SHA51238118718d6c74ab9a359307cf645bac788c1b7c9f0fbd838bc0c8331997dbbe8252f0e5978a2bf631e68020537406387b378f791d39e7a58aa5033d757f8f82f