Malware Analysis Report

2024-11-15 07:20

Sample ID 240314-et2absab8v
Target 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
SHA256 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710

Threat Level: Known bad

The file 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710 was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Renames multiple (566) files with added filename extension

Renames multiple (304) files with added filename extension

Executes dropped EXE

Deletes itself

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Drops desktop.ini file(s)

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Sets desktop wallpaper using registry

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: RenamesItself

Enumerates system info in registry

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies Control Panel

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 04:14

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 04:14

Reported

2024-03-14 04:17

Platform

win7-20240221-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe"

Signatures

Renames multiple (304) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\29EE.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\29EE.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cfNIlfFVm.bmp" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cfNIlfFVm.bmp" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\29EE.tmp N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cfNIlfFVm C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cfNIlfFVm\ = "cfNIlfFVm" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm\DefaultIcon C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm\DefaultIcon\ = "C:\\ProgramData\\cfNIlfFVm.ico" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe

"C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe"

C:\ProgramData\29EE.tmp

"C:\ProgramData\29EE.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\29EE.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x14c

Network

N/A

Files

memory/2384-0-0x00000000023C0000-0x0000000002400000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\FFFFFFFFFFF

MD5 b020e3cd06e05148a319c1ddd6132e74
SHA1 a6957524785d1bfa93b5253cffe4a26ce20a833d
SHA256 668da8e2e05f0ae7c27bd9ad7c1c9dc31cc224b8e7a61f5680056e006ef00529
SHA512 14f72424adb306a30f0fd933fe0f885feb772d2a16820d63df2cc049ed03c42dee50622e628539f1a59ada4b8b18458c5efcb177ca69082e8a064a1b1d7596e7

F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-1000\DDDDDDDDDDD

MD5 ba9ac26bb0304d1ed3f4b23691b6fb3e
SHA1 e1bf42f90a6143801b0a0e6dd54e314d575f97c7
SHA256 34bf1b9f4086a270cb65407ede6f26ac17719faf9bd3c69c3a18747b4a915b47
SHA512 d29935ab724ae0654dbc664c94337bf0a42071098d5b6a4d10937e32fb33f2dfc53325d631afee889353cf53139ce6355cd5970d4dba28662d3a4d10d67a1509

C:\cfNIlfFVm.README.txt

MD5 6fddbb67449386a250339c4149205c15
SHA1 3a26c951d7674776d27a80ee60fa531728961889
SHA256 42eb2e6b157ea363039e1678a18fa8c546163bdd2dad6cd3a060f1970670c0c6
SHA512 671749adc6d245d369fc67aa843a9e7edf07336a395c7703abdd082973234e131134fee65a8ce9ac9fe5d379e9c57271f59a93942d96b4200bc561a75e8d6ff7

\ProgramData\29EE.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1464-822-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/1464-823-0x00000000002E0000-0x0000000000320000-memory.dmp

memory/1464-829-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/1464-830-0x000000007EF20000-0x000000007EF21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 a701fd2ca0d09ceea81ebc69442c734e
SHA1 f76e43f8b0eb95dd1430ee98e0f6afe3ce7f3da3
SHA256 4ce9b353cf41b5472ff2965bbde3393f9fdd0a6adcf88a6ab45902fce26c7695
SHA512 640c804f2d52b859c6c1255a766286c36639364345f095ad85f5f647f07f3e2cdf248811ebcb6b2f950803933918a469f2d0a7a3a73ab6b534000f1c2d75450e

memory/1464-855-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/1464-854-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 04:14

Reported

2024-03-14 04:17

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe"

Signatures

Renames multiple (566) files with added filename extension

ransomware

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\ProgramData\7FEF.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\7FEF.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\7FEF.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPa17nmxr0s0v1q8fcou8ymbyub.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPqqs52zdckmzgo8y80nxup3_ad.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPhnr3pjt8i9ibu6fhpaa3bw6nb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\cfNIlfFVm.bmp" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\cfNIlfFVm.bmp" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\7FEF.tmp N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm\DefaultIcon\ = "C:\\ProgramData\\cfNIlfFVm.ico" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cfNIlfFVm C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cfNIlfFVm\ = "cfNIlfFVm" C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm\DefaultIcon C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cfNIlfFVm C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe C:\Windows\splwow64.exe
PID 2020 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe C:\Windows\splwow64.exe
PID 2548 wrote to memory of 2972 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2548 wrote to memory of 2972 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 2020 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe C:\ProgramData\7FEF.tmp
PID 2020 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe C:\ProgramData\7FEF.tmp
PID 2020 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe C:\ProgramData\7FEF.tmp
PID 2020 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe C:\ProgramData\7FEF.tmp
PID 4684 wrote to memory of 1768 N/A C:\ProgramData\7FEF.tmp C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 1768 N/A C:\ProgramData\7FEF.tmp C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 1768 N/A C:\ProgramData\7FEF.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe

"C:\Users\Admin\AppData\Local\Temp\77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C8D69C0B-6C1F-4CC2-B6C9-0C3E04FFE60D}.xps" 133548632973490000

C:\ProgramData\7FEF.tmp

"C:\ProgramData\7FEF.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\7FEF.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 66.112.168.52.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 211.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 42.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

memory/2020-0-0x00000000025F0000-0x0000000002600000-memory.dmp

memory/2020-1-0x00000000025F0000-0x0000000002600000-memory.dmp

memory/2020-2-0x00000000025F0000-0x0000000002600000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-983155329-280873152-1838004294-1000\EEEEEEEEEEE

MD5 3642c73399f447d2bea96255d1a8bb5d
SHA1 ad225243a11cc6f17ad206b8ab8a55bb7faf2544
SHA256 d947c6609f68d12219fb7d8311bd8df60318491d6d86b81de35589d45102036e
SHA512 ecb6f09682b4a18c5ad76049d20b791c49896b2aac23da27129df70c73e80a4e0aba3a2dd5a66c9133c4620ac60fd58eace244b84b644f7090fc964d1381558e

C:\cfNIlfFVm.README.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

F:\$RECYCLE.BIN\S-1-5-21-983155329-280873152-1838004294-1000\DDDDDDDDDDD

MD5 4f35b788bfa0632b9560a4ca44fd48b1
SHA1 47bf3a369681b709ebb63f05d03a29ce473490d5
SHA256 f61f59900546a9ff406d396d318505c24b4ec86031aa1d37c931f0871e5129a0
SHA512 efb319ab76b1ea49bef17f0108e3b9c5de156e5ea993954429bb9e3bef75fc4d4668637d487631f608394778dfaf7bce32cb2a2c8d2535268f18291bcb339d0d

memory/2972-2726-0x00007FFD21B50000-0x00007FFD21B60000-memory.dmp

C:\ProgramData\7FEF.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2972-2731-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2730-0x00007FFD21B50000-0x00007FFD21B60000-memory.dmp

memory/2972-2727-0x00007FFD21B50000-0x00007FFD21B60000-memory.dmp

memory/2972-2734-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2733-0x00007FFD21B50000-0x00007FFD21B60000-memory.dmp

memory/2972-2737-0x00007FFD21B50000-0x00007FFD21B60000-memory.dmp

memory/2972-2736-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 5e102d07a4562bc81343f0913eb2a486
SHA1 61f993da399b26a37395ba7d460ba0d260feaeee
SHA256 910fd386f89ca90aaf5c19b9026218abf27b9ced3d0ecd57ae1d2038f90c1ab4
SHA512 3ab301ad469c42f9b68a0e2bc8d9016c80a8084946a86253524ce9d5472ece9162d872790af53bcae7f117b4a5347108a6550ae262a933922bbac8f86038a589

memory/2972-2766-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2767-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2768-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2770-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2771-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2769-0x00007FFD1F330000-0x00007FFD1F340000-memory.dmp

memory/2972-2772-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2773-0x00007FFD1F330000-0x00007FFD1F340000-memory.dmp

memory/2972-2774-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2775-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2776-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2777-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2778-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2779-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2780-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2781-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{8B14D356-A49F-4008-BA19-24E587C24A32}

MD5 4d2e38449ad9f8a27c16839db7898df6
SHA1 a59ee0213bbdbc15306184dc9a24ff66756767df
SHA256 c50869d6d2e37b12d593017eb016cfe19e896227b28f10571d7158d6871e034c
SHA512 cd8059c4e64f9c13c7b747061cf229435dbf729abd4f74a9e53771ec01d29476dbadb833099e6f2d151ca8612a0640f4e424a77fd7e0a756e4c6de5ea6fe6324

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 0ef0a8094bca03ab58c1d728fc290dfa
SHA1 dd59e24938a7516c621704ec95d63c98d405ae26
SHA256 a352c879accb8baded8b50b6a0d8e745d2071ed26883602bc6dd37b9aa7fef37
SHA512 efb66148f4e37dcaf81afeb26f815dff1920ffb09181dfeefdf248438a4f2bc0ab42615584137688ce6d350e8f989470537bbf858119b63da94331b4c911189c

memory/2972-2803-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp

memory/2972-2804-0x00007FFD61AD0000-0x00007FFD61CC5000-memory.dmp