Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:21
Behavioral task
behavioral1
Sample
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe
Resource
win10v2004-20240226-en
General
-
Target
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe
-
Size
153KB
-
MD5
aab7e6cfae95a4eae23a4db81841421c
-
SHA1
a1fe8e62f1a39b8772772224641c3842a79747b5
-
SHA256
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122
-
SHA512
01395cf60bf40f400e0f5bb93f22db45a9ebbe7f7d99ac7df4da340d5e2b10ce65c7da0e59d71e7bd5b1d46aabc82b0dcbd2358d73370201d9517aad30e66977
-
SSDEEP
3072:jqJogYkcSNm9V7Da2WTcOAil3jtxC2MT:jq2kc4m9tD+Ndjzj
Malware Config
Extracted
C:\j3ncKbrq7.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (600) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPnxl31yh2q05hk7f01a3_nanl.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPyspk9kicu0xk2x95yy9xiylub.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPzy6hx3k_ck0xpl5ny1s59pcfb.TMP printfilterpipelinesvc.exe -
Modifies registry class 5 IoCs
Processes:
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.j3ncKbrq7 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.j3ncKbrq7\ = "j3ncKbrq7" ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7\DefaultIcon ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7\DefaultIcon\ = "C:\\ProgramData\\j3ncKbrq7.ico" ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exepid process 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeDebugPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: 36 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeImpersonatePrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeIncBasePriorityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeIncreaseQuotaPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: 33 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeManageVolumePrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeProfSingleProcessPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeRestorePrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSystemProfilePrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeTakeOwnershipPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeShutdownPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeDebugPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeBackupPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe Token: SeSecurityPrivilege 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exedescription pid process target process PID 4884 wrote to memory of 212 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe splwow64.exe PID 4884 wrote to memory of 212 4884 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe"C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe"1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5064
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
PID:4216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5b972f9d15fb3736233a5deaad36cc717
SHA1bbe877e76cbefe77201f9aa5881de50bb14c6273
SHA2565a4e54fad1b51382ad8435af8e5c82f1d23b0c80c15ad766ccd32a55867f781e
SHA5128b9db97b9bfd5ad008e0c7e7d01c3fcecadc0255110bedbb7f645d7d771efbfddc5ad4ebc99acee28a2da2f28bafde6a636be83e2ad1e3e7bc81c8c23044bb30
-
Filesize
6KB
MD5f964d56bc1e004a0faf927e047194535
SHA1bc35bae6defe3d1e49b4e16c9f601e7a5cc8eb2e
SHA256e7c7cadd331c672d2f03f784d431980221051cda1abe860b637d7e8ada7a1e61
SHA51224f318f175b90fb1f9644d5becce7ade996003c7bf6ebe675f191694c6e537f29481e511f64769cb405c7a2edf14123984946488eb52a1daf24a9ec9d580a56d
-
Filesize
129B
MD5b5b2736405e53f77f98ce21a1e58c8a3
SHA1022a7a25e10fc3a218a743b2d846534116ecfb00
SHA2562452e85e8bae91eebfa0eb2a149a238262f8d679008b910a2021f8c83a41de48
SHA512062ba61ecce4f2d8695742ba8d6c29688678b5da7f53a1448f98a4f21d110d6736651bf2608c08f4b4b5a9c33363017908b41460f1fe667e2e56df41a8a97f3f