Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:14
Behavioral task
behavioral1
Sample
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe
Resource
win10v2004-20240226-en
General
-
Target
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe
-
Size
147KB
-
MD5
c1eb609c9ed588d372091d5531a74aeb
-
SHA1
faf042b6cef13d0d46c5b5e7f3f5a595fa0a5952
-
SHA256
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e
-
SHA512
828356900e5dc26d4e371b76504dfb4af3b4594708cb4acc76b22e69dc1766f5558ff55d0cbe0fa408fb97ca5741a08f6551b29fddebf6cddb35b6c0084a40c1
-
SSDEEP
3072:w6glyuxE4GsUPnliByocWepkEa9YmM31iA9uHZiW:w6gDBGpvEByocWeJhRFwAW
Malware Config
Extracted
C:\zvV4dTvWn.README.txt
lockbit
https://t.me/P3NT3ST_R00T
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (562) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
66C9.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 66C9.tmp -
Deletes itself 1 IoCs
Processes:
66C9.tmppid process 4948 66C9.tmp -
Executes dropped EXE 1 IoCs
Processes:
66C9.tmppid process 4948 66C9.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Drops file in System32 directory 4 IoCs
Processes:
printfilterpipelinesvc.exesplwow64.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\PPyfoc325g4h47eh9sclvqrbi_.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP_v2iw89x9q0iz88rt4_ikku5c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP3ifgak51dv33sknjjlwykmto.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\zvV4dTvWn.bmp" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\zvV4dTvWn.bmp" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe66C9.tmppid process 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 4948 66C9.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\Desktop\WallpaperStyle = "10" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Modifies registry class 5 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zvV4dTvWn\DefaultIcon\ = "C:\\ProgramData\\zvV4dTvWn.ico" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zvV4dTvWn 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zvV4dTvWn\ = "zvV4dTvWn" 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zvV4dTvWn\DefaultIcon 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zvV4dTvWn 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exepid process 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
66C9.tmppid process 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp 4948 66C9.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeDebugPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: 36 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeImpersonatePrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeIncBasePriorityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeIncreaseQuotaPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: 33 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeManageVolumePrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeProfSingleProcessPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeRestorePrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSystemProfilePrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeTakeOwnershipPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeShutdownPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeDebugPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeBackupPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe Token: SeSecurityPrivilege 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid process 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE 1432 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exeprintfilterpipelinesvc.exe66C9.tmpdescription pid process target process PID 1008 wrote to memory of 2544 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe splwow64.exe PID 1008 wrote to memory of 2544 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe splwow64.exe PID 3184 wrote to memory of 1432 3184 printfilterpipelinesvc.exe ONENOTE.EXE PID 3184 wrote to memory of 1432 3184 printfilterpipelinesvc.exe ONENOTE.EXE PID 1008 wrote to memory of 4948 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 66C9.tmp PID 1008 wrote to memory of 4948 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 66C9.tmp PID 1008 wrote to memory of 4948 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 66C9.tmp PID 1008 wrote to memory of 4948 1008 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe 66C9.tmp PID 4948 wrote to memory of 3216 4948 66C9.tmp cmd.exe PID 4948 wrote to memory of 3216 4948 66C9.tmp cmd.exe PID 4948 wrote to memory of 3216 4948 66C9.tmp cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe"C:\Users\Admin\AppData\Local\Temp\7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2544
-
-
C:\ProgramData\66C9.tmp"C:\ProgramData\66C9.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\66C9.tmp >> NUL3⤵PID:3216
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3116
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{744DDACA-614D-47F4-8413-0E1539BCFF1D}.xps" 1335486330750700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD597dbf3d651e7b08f8daffa1bd1e64a4b
SHA11b68029275d70554345ad4ecfde5614fe44da3ef
SHA256a66a260b7e250430b6d127c333be9fea30ed6c87b2873c21d037d84196861008
SHA5127d35a7688cc80e8a0287e4f0c82713e72159501f439096d7cf3e4cdc15411aac080e353bf7c6bd7f9e36a9b06c2340af692714eb09bfacfffd9ebbe18ea6e89e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize147KB
MD5be025835be60bbb8e8eeea6a0cfe33fb
SHA198c76c626c38b88f51fabd859140980e2ae999fa
SHA2567547bb7d966e9c07faefd07d04fbda1524d18fb202ee1b8c8b597cd9651ba030
SHA512755d300c13c8e73333b815cbae99a7bed797eb1b8310451e13a494c46347155c9b8702b5391a00ba04e8ed68dcbc598ba64234e45ef85d4de76c718880a43e74
-
Filesize
4KB
MD5bf13d87846cbc3655f9d2915244a53f7
SHA1cc6494ef21439fe2a9db5bf02a24c7898df2e071
SHA2564c1a1c706c208c694dcfbd7415a45d80e2a92ff8fdbf6a1b0a855eb2d3486359
SHA512ddd5ee5ca45dca7bb1e964bad95fc536f31deadf16101ff9f36e28330c8ba96892f5a236b256ea9f7e4b4542158d6acf1018e16eb397c11176c509bca35f81ad
-
Filesize
4KB
MD5acc13c7c189a347ee411510944595b7b
SHA11df59c80314cf657900da57e4e0b014860b54fbc
SHA256032b49ad52964537618c0fc67a9c64ebdf88e5ea2c067a1dc1c5f715a14c9f32
SHA51266c0de8f91abd03683d9ed2569b7d4a09a1f4312bf38318c0f0c182885db2c7ef96894bd317535e7b9b6800efd29e94f2d772b4b801a0f4e93b49dfee6f371cd
-
Filesize
1KB
MD5bf7ae8f47d8fa0ac5dcadc18c81e5a04
SHA14be4e42d3f6bd15e4b7fc11d8b54a6a1839d37be
SHA256522d831a26affafa89499382925defcfc377e24a4c1904b30bae4ed73d3d85ff
SHA5129ff0f8236251b81c335e61e2e8ede40a0cbeaa36afdb46b040daeb85c548d0db87b46a7fabf3bfe7e04bd2dec9d09fb2847a94a4b9b908612f4f4a9a3ff6269a
-
Filesize
129B
MD55e9472c4fb0a14b996f77e72a88ce04f
SHA10be20e8a7c422651347bff3d519ac3068eb57b2d
SHA256e4b3fe0434750ad8d5d1daddc164cebf8d200e8d9de21c2ced67baba6b4243f0
SHA512a64eefa6c859e515e115ed276ee966988854e2e9d56228122e195ebdd6d513fb04e1a51b7f1da40386147877bdcef8b3b8615ddc6a92a75eb8f82f2323bc024d