Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:14
Behavioral task
behavioral1
Sample
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe
Resource
win10v2004-20240226-en
General
-
Target
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe
-
Size
151KB
-
MD5
033b58faabb72627b43d7048448e635a
-
SHA1
f29a804d3d98681e556f95351b0ed9c74770e903
-
SHA256
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
-
SHA512
bbee4304bea99f4df82339beff68999f6d544fe021876e6dd2572c3ac4184f3ecddc061e442c20b9a3a4b8b439afcd62f9ebfa6018d7c0b6f51da18658b2f92b
-
SSDEEP
3072:rqJogYkcSNm9V7DOYvvNzONDmi3iluo9dhg+rxaeP8MT:rq2kc4m9tDptOckiYo9d6mYek
Malware Config
Extracted
C:\cfNIlfFVm.README.txt
3GPDWEAGj5dYmbfr4zuncDcibkBJ3LHLRS
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
https://tox.chat/download.html
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
Signatures
-
Renames multiple (566) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7FEF.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 7FEF.tmp -
Deletes itself 1 IoCs
Processes:
7FEF.tmppid process 4684 7FEF.tmp -
Executes dropped EXE 1 IoCs
Processes:
7FEF.tmppid process 4684 7FEF.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPa17nmxr0s0v1q8fcou8ymbyub.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPqqs52zdckmzgo8y80nxup3_ad.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPhnr3pjt8i9ibu6fhpaa3bw6nb.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cfNIlfFVm.bmp" 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cfNIlfFVm.bmp" 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
7FEF.tmppid process 4684 7FEF.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\WallpaperStyle = "10" 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe -
Modifies registry class 5 IoCs
Processes:
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm\DefaultIcon\ = "C:\\ProgramData\\cfNIlfFVm.ico" 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cfNIlfFVm 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cfNIlfFVm\ = "cfNIlfFVm" 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm\DefaultIcon 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exepid process 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
7FEF.tmppid process 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp 4684 7FEF.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeDebugPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: 36 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeImpersonatePrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeIncBasePriorityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeIncreaseQuotaPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: 33 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeManageVolumePrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeProfSingleProcessPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeRestorePrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSystemProfilePrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeTakeOwnershipPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeShutdownPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeDebugPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeBackupPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe Token: SeSecurityPrivilege 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid process 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE 2972 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exeprintfilterpipelinesvc.exe7FEF.tmpdescription pid process target process PID 2020 wrote to memory of 5100 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe splwow64.exe PID 2020 wrote to memory of 5100 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe splwow64.exe PID 2548 wrote to memory of 2972 2548 printfilterpipelinesvc.exe ONENOTE.EXE PID 2548 wrote to memory of 2972 2548 printfilterpipelinesvc.exe ONENOTE.EXE PID 2020 wrote to memory of 4684 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 7FEF.tmp PID 2020 wrote to memory of 4684 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 7FEF.tmp PID 2020 wrote to memory of 4684 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 7FEF.tmp PID 2020 wrote to memory of 4684 2020 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe 7FEF.tmp PID 4684 wrote to memory of 1768 4684 7FEF.tmp cmd.exe PID 4684 wrote to memory of 1768 4684 7FEF.tmp cmd.exe PID 4684 wrote to memory of 1768 4684 7FEF.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe"C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:5100
-
-
C:\ProgramData\7FEF.tmp"C:\ProgramData\7FEF.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7FEF.tmp >> NUL3⤵PID:1768
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4548
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C8D69C0B-6C1F-4CC2-B6C9-0C3E04FFE60D}.xps" 1335486329734900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD53642c73399f447d2bea96255d1a8bb5d
SHA1ad225243a11cc6f17ad206b8ab8a55bb7faf2544
SHA256d947c6609f68d12219fb7d8311bd8df60318491d6d86b81de35589d45102036e
SHA512ecb6f09682b4a18c5ad76049d20b791c49896b2aac23da27129df70c73e80a4e0aba3a2dd5a66c9133c4620ac60fd58eace244b84b644f7090fc964d1381558e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize151KB
MD55e102d07a4562bc81343f0913eb2a486
SHA161f993da399b26a37395ba7d460ba0d260feaeee
SHA256910fd386f89ca90aaf5c19b9026218abf27b9ced3d0ecd57ae1d2038f90c1ab4
SHA5123ab301ad469c42f9b68a0e2bc8d9016c80a8084946a86253524ce9d5472ece9162d872790af53bcae7f117b4a5347108a6550ae262a933922bbac8f86038a589
-
Filesize
4KB
MD54d2e38449ad9f8a27c16839db7898df6
SHA1a59ee0213bbdbc15306184dc9a24ff66756767df
SHA256c50869d6d2e37b12d593017eb016cfe19e896227b28f10571d7158d6871e034c
SHA512cd8059c4e64f9c13c7b747061cf229435dbf729abd4f74a9e53771ec01d29476dbadb833099e6f2d151ca8612a0640f4e424a77fd7e0a756e4c6de5ea6fe6324
-
Filesize
4KB
MD50ef0a8094bca03ab58c1d728fc290dfa
SHA1dd59e24938a7516c621704ec95d63c98d405ae26
SHA256a352c879accb8baded8b50b6a0d8e745d2071ed26883602bc6dd37b9aa7fef37
SHA512efb66148f4e37dcaf81afeb26f815dff1920ffb09181dfeefdf248438a4f2bc0ab42615584137688ce6d350e8f989470537bbf858119b63da94331b4c911189c
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
129B
MD54f35b788bfa0632b9560a4ca44fd48b1
SHA147bf3a369681b709ebb63f05d03a29ce473490d5
SHA256f61f59900546a9ff406d396d318505c24b4ec86031aa1d37c931f0871e5129a0
SHA512efb319ab76b1ea49bef17f0108e3b9c5de156e5ea993954429bb9e3bef75fc4d4668637d487631f608394778dfaf7bce32cb2a2c8d2535268f18291bcb339d0d