Analysis
-
max time kernel
14s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:14
Behavioral task
behavioral1
Sample
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe
Resource
win10v2004-20240226-en
General
-
Target
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe
-
Size
153KB
-
MD5
03caa545a7ac746536838a93a772e0bf
-
SHA1
3b2c3bd5cd90c88575398921f8fb82853e192aea
-
SHA256
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630
-
SHA512
b5671dac9dd3fe6e9b556b605e93ad4c19f7f4b45d67a2e83221a99efc00557e9275fc4442226c86d08fa8c5b586f6c0f58c394caabffc815a427c3273cd2e73
-
SSDEEP
3072:k6glyuxE4GsUPnliByocWep+r/7NYnfcCeFEhjvk:k6gDBGpvEByocWeIGn0C5tvk
Malware Config
Extracted
C:\hi3mgYt1D.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (577) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
Processes:
6E6A.tmppid process 3080 6E6A.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe -
Drops file in System32 directory 4 IoCs
Processes:
printfilterpipelinesvc.exesplwow64.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\PPl6x6n0nlgs3b0ur0slhu7ac_.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP6duftjsdl0m5e0mp8qyotnosb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP1grf9exhdq1pv7r9okxrt659d.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\hi3mgYt1D.bmp" 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\hi3mgYt1D.bmp" 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exepid process 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe -
Modifies Control Panel 2 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\WallpaperStyle = "10" 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe -
Modifies registry class 5 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hi3mgYt1D 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hi3mgYt1D\ = "hi3mgYt1D" 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hi3mgYt1D\DefaultIcon 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\hi3mgYt1D 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\hi3mgYt1D\DefaultIcon\ = "C:\\ProgramData\\hi3mgYt1D.ico" 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exepid process 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeDebugPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: 36 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeImpersonatePrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeIncBasePriorityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeIncreaseQuotaPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: 33 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeManageVolumePrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeProfSingleProcessPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeRestorePrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSystemProfilePrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeTakeOwnershipPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeShutdownPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeDebugPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeBackupPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe Token: SeSecurityPrivilege 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exeprintfilterpipelinesvc.exedescription pid process target process PID 1760 wrote to memory of 4468 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe splwow64.exe PID 1760 wrote to memory of 4468 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe splwow64.exe PID 4888 wrote to memory of 4960 4888 printfilterpipelinesvc.exe ONENOTE.EXE PID 4888 wrote to memory of 4960 4888 printfilterpipelinesvc.exe ONENOTE.EXE PID 1760 wrote to memory of 3080 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 6E6A.tmp PID 1760 wrote to memory of 3080 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 6E6A.tmp PID 1760 wrote to memory of 3080 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 6E6A.tmp PID 1760 wrote to memory of 3080 1760 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe 6E6A.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe"C:\Users\Admin\AppData\Local\Temp\6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4468
-
-
C:\ProgramData\6E6A.tmp"C:\ProgramData\6E6A.tmp"2⤵
- Executes dropped EXE
PID:3080
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1160
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{758F371A-98ED-4353-8C21-15B267A5A493}.xps" 1335486325365600002⤵PID:4960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5df9eb6c4ea9447532d2a11a9f855dae8
SHA17b8306629ce8fd6a81062fbd1d69d418057b8c79
SHA256b765817b30336638bfd64a1868685d509cc500ba026f8b87ba79980ca580e2cf
SHA5120f42ec8f03d7a2b3d3aee8f55f724d909ccc22f67d8f510306aa8a32a55088596f10222d635c63acd908afdbd91214db53d815b796da94ba3f637d5e4cb3a0de
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
6KB
MD5444365121dee5baeaa1326e8fcdc087e
SHA1758f11d7d406d5f07f3ed645d380640608d60f8e
SHA256fa7abba59c84417df94dd927be28d5c36505997957313e5d5c78410cf77d281d
SHA5122c43bdd338a8883dbd34663bcde1899c3c19f2efd0dde75735a6b8fcabca3e6d5fa67f5854525ce89f73dedc911d3fa85e29ab91ee7794d1b80a22c71daa02d7
-
Filesize
129B
MD5969c41c4c325e2d6805eae163d6b6081
SHA1a70c6cb20460be906a264ad237f60c37da75881c
SHA256b29ed94e7a41146cd5bfacc411dec415cf08814d838f6d620401c2bc7645eb30
SHA5123fcc779d4fa57c7b7712a605e62a215ef4d49ab4b825f0359b94365251c69c82f166b55f2472ca76a3bd57e032661ca0d362fad5cc5556cdd2bf08298d8a3205