Malware Analysis Report

2024-11-15 07:20

Sample ID 240314-eswcpaab6s
Target 588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845
SHA256 588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845

Threat Level: Known bad

The file 588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845 was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (354) files with added filename extension

Renames multiple (616) files with added filename extension

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Deletes itself

Loads dropped DLL

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious behavior: RenamesItself

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Checks processor information in registry

Modifies Control Panel

Modifies registry class

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 04:12

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 04:12

Reported

2024-03-14 04:15

Platform

win7-20240221-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe"

Signatures

Renames multiple (354) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\4588.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\4588.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\BR6hZGUB2.bmp" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\BR6hZGUB2.bmp" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.BR6hZGUB2 C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.BR6hZGUB2\ = "BR6hZGUB2" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BR6hZGUB2\DefaultIcon C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BR6hZGUB2 C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BR6hZGUB2\DefaultIcon\ = "C:\\ProgramData\\BR6hZGUB2.ico" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe

"C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe"

C:\ProgramData\4588.tmp

"C:\ProgramData\4588.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\4588.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x148

Network

N/A

Files

memory/2192-0-0x0000000000AF0000-0x0000000000B30000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini

MD5 da874c79516e02e1f86ff950a8f51ddc
SHA1 0fe40957f81b91af161e901835352430849b9ec2
SHA256 2a133a5136a4005006630da88b73c1e7bc901ba32e19ae7af88fc82c2be1b28e
SHA512 80a5bc832166af515cacc722251edc2b6c7acc6054c278f25bdbb436e230756d70b3a0f4638a859d4f27be086b56828bc8082cf15e26e932d6ad5a89079fdd20

F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\DDDDDDDDDDD

MD5 4ec40c1c2ce321b0623c5a24d09599b3
SHA1 d2d42f9543af181bfec7848b895d7c3eadce62a6
SHA256 fe10f8008a169e41b3a4aaf3ae7fedae0e90c8f534858a51d64b4c4937802b5c
SHA512 7818984abc94d763988f25e61c5d3e2e553015f3d0deed17cb4b09fc617ce60f0df541d8c87f4caf217981a328c3ef9dfe3f29be0fff1025639d35bedcd35c19

C:\BR6hZGUB2.README.txt

MD5 ac20ec8df145e03672c7aceea15fd00d
SHA1 7b1b94dacc53f753301f2fb05075c94847b5ef51
SHA256 3a077461e18bdef692b5bb6aaa4dca98d511670f3aec3e4fac8902ee73d2d0a2
SHA512 3a1751ebfe8bb845b769b0039ccc878602f47685324d9e838fb130db8947feb3ce0459eda0d7a2ff16a96deb740b5b9aaa0a22c1089c587a132ba3b9b27ea3fd

\ProgramData\4588.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2264-880-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2264-883-0x00000000003B0000-0x00000000003F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 88b6651fb5067b789a6fed114ba7f8f5
SHA1 5559d833f3f4082ca86feff6f4acc812f6462efc
SHA256 9dd2f28c2199a084528ea29addf3de796f257a31704e56f853c6938b04dae9d4
SHA512 adbcb2735ae3aebc4ea1e23cd5d8ddfb911b8d44d1ff9b43161a3c76b58d169834a371378c1822c3319297195f6c88d64362319d3c7eb1b1fb11ffff548506d7

memory/2264-889-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2264-891-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2264-912-0x000000007EF40000-0x000000007EF41000-memory.dmp

memory/2264-913-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 04:12

Reported

2024-03-14 04:15

Platform

win10v2004-20240226-en

Max time kernel

159s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe"

Signatures

Renames multiple (616) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\ProgramData\1FFE.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\1FFE.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\1FFE.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PP49_sb06c_umx08knhmd8i2bqb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP3zgo6cnsprzpngbvulk3jtxpc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP2g1uqk5z1c5_9i0y15ie1femc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\BR6hZGUB2.bmp" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\BR6hZGUB2.bmp" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BR6hZGUB2\DefaultIcon C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BR6hZGUB2 C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BR6hZGUB2\DefaultIcon\ = "C:\\ProgramData\\BR6hZGUB2.ico" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.BR6hZGUB2 C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.BR6hZGUB2\ = "BR6hZGUB2" C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5064 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe C:\Windows\splwow64.exe
PID 5064 wrote to memory of 712 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe C:\Windows\splwow64.exe
PID 3288 wrote to memory of 4908 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3288 wrote to memory of 4908 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 5064 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe C:\ProgramData\1FFE.tmp
PID 5064 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe C:\ProgramData\1FFE.tmp
PID 5064 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe C:\ProgramData\1FFE.tmp
PID 5064 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe C:\ProgramData\1FFE.tmp
PID 4380 wrote to memory of 4548 N/A C:\ProgramData\1FFE.tmp C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 4548 N/A C:\ProgramData\1FFE.tmp C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 4548 N/A C:\ProgramData\1FFE.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe

"C:\Users\Admin\AppData\Local\Temp\588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{23EBEB34-C5FF-47A8-9A1C-6509EAB60C1F}.xps" 133548632906600000

C:\ProgramData\1FFE.tmp

"C:\ProgramData\1FFE.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\1FFE.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 27.73.42.20.in-addr.arpa udp

Files

memory/5064-0-0x0000000003280000-0x0000000003290000-memory.dmp

memory/5064-1-0x0000000003280000-0x0000000003290000-memory.dmp

memory/5064-2-0x0000000003280000-0x0000000003290000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\FFFFFFFFFFF

MD5 06154bf3084d156e70b6569a115094f8
SHA1 03a411813ae3cbbf689a199a499f2c6c3943b6b0
SHA256 06a914c558badf0414a0527dbb480ccc378d674d989e7c3a2f4355c155fa5ec4
SHA512 f916fa847d9f980f6a042071c755c89172f4f540e28f1504f860a2800c22c623666c668352f10697a990e8f3055c95797cb2c4414277bbb28146a637c25895e7

F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\BBBBBBBBBBB

MD5 b020012c39bc6834d865699f9e583acd
SHA1 8a0446264acc65800948aac7aa144c6e2c8b6acd
SHA256 e685b44f708c651bf8d45d7ade7945a8027de4706c42485172bf27b6a70bf1a3
SHA512 7178cb8d0ad7a29811eb3bedec68925d3230f79552c61093098f6bbedb3b02875a1a841d4dc007de7c3813e88e2e33c221aefa9c077912c893c09083bb16f9b6

C:\BR6hZGUB2.README.txt

MD5 ac20ec8df145e03672c7aceea15fd00d
SHA1 7b1b94dacc53f753301f2fb05075c94847b5ef51
SHA256 3a077461e18bdef692b5bb6aaa4dca98d511670f3aec3e4fac8902ee73d2d0a2
SHA512 3a1751ebfe8bb845b769b0039ccc878602f47685324d9e838fb130db8947feb3ce0459eda0d7a2ff16a96deb740b5b9aaa0a22c1089c587a132ba3b9b27ea3fd

memory/5064-791-0x0000000003280000-0x0000000003290000-memory.dmp

memory/5064-792-0x0000000003280000-0x0000000003290000-memory.dmp

memory/5064-793-0x0000000003280000-0x0000000003290000-memory.dmp

memory/4908-2797-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmp

memory/4908-2798-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmp

memory/4908-2800-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmp

memory/4908-2801-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2802-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmp

memory/4908-2803-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2804-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2799-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2806-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2805-0x00007FFEB60F0000-0x00007FFEB6100000-memory.dmp

memory/4908-2816-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2817-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2818-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

C:\ProgramData\1FFE.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4380-2827-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

memory/4380-2826-0x000000007FE20000-0x000000007FE21000-memory.dmp

memory/4380-2825-0x00000000023E0000-0x00000000023F0000-memory.dmp

memory/4380-2824-0x00000000023E0000-0x00000000023F0000-memory.dmp

memory/4380-2823-0x000000007FE40000-0x000000007FE41000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 bcf22f571cbb659b425b8cd702f6101e
SHA1 0795d2a1ed0e5d0d1b132394dc778d50b221bc51
SHA256 9964ad845df38f078c66afcdcb8c6d886a190062bed4e3ec806e1f1ed4548f4b
SHA512 82aa398fe0c8e784df07475a943b244aff69aaf8eae242e978cbad0a3829c513fc7435ced785a4c7d6a6cd35069deeb3ffc573401df9d3b44bf65499f72b0d68

memory/4380-2857-0x000000007FE00000-0x000000007FE01000-memory.dmp

memory/4380-2856-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

memory/4908-2858-0x00007FFEB3C20000-0x00007FFEB3C30000-memory.dmp

memory/4908-2859-0x00007FFEB3C20000-0x00007FFEB3C30000-memory.dmp

memory/4908-2866-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

memory/4908-2867-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{0B70F720-DDF6-4EC6-BF8B-DAA5A239820D}

MD5 a4b1b1cd4723f1ae1745fa6e81f09681
SHA1 3b1ea5baffa653fe0b0692b69ff819642eb9231a
SHA256 f019e8c7be6edc144ee49e9e1d758f3187b49a7b53facbac8742c4a5cd966b99
SHA512 0c574dce212494cdf6e36f42763bf569a7ec33697d52035bd34ce9af54f9f6c6d3f688227ebea47c20f5fc19b0f545d33f1b2f51f200f271a976de488124aaa8

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 c0a102d1ec55fbac2ad95b8953884653
SHA1 ea8ec0998c3dea92877c0f7330627ed9269837d4
SHA256 1e5129bd909d60c80afcf1fa900de59e7dda9acda0745b3330bc5b650bc6444a
SHA512 24594ca7141bc5dabf707ef9317f7cac68729446a01a9cb779b175de33d022ab22553ab531b2764aeb59bd805af7328140ce3d77e3d1a5e8328eccaa7b67c824