Malware Analysis Report

2024-11-13 14:57

Sample ID 240314-eyrxfscf22
Target ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122
SHA256 ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122
Tags
lockbit ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122

Threat Level: Known bad

The file ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122 was found to be: Known bad.

Malicious Activity Summary

lockbit ransomware spyware stealer

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit

Renames multiple (600) files with added filename extension

Renames multiple (314) files with added filename extension

Deletes itself

Reads user/profile data of web browsers

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Sets desktop wallpaper using registry

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies Control Panel

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-14 04:21

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-14 04:21

Reported

2024-03-14 04:24

Platform

win7-20240221-en

Max time kernel

151s

Max time network

164s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (314) files with added filename extension

ransomware

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\AAA1.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\AAA1.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-778096762-2241304387-192235952-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-778096762-2241304387-192235952-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\j3ncKbrq7.bmp" C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\j3ncKbrq7.bmp" C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\ProgramData\AAA1.tmp N/A

Enumerates physical storage devices

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.j3ncKbrq7 C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.j3ncKbrq7\ = "j3ncKbrq7" C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7 C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7\DefaultIcon\ = "C:\\ProgramData\\j3ncKbrq7.ico" C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe

"C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe"

C:\ProgramData\AAA1.tmp

"C:\ProgramData\AAA1.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AAA1.tmp >> NUL

Network

N/A

Files

memory/884-0-0x0000000002310000-0x0000000002350000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-778096762-2241304387-192235952-1000\desktop.ini

MD5 510244ba36e758b62da2ffde7b887c19
SHA1 1e6687e895327844a1d3e37cfb369c04c0b566b5
SHA256 37b9fa9a098e548a7e146150549510a8b13607ab6cd946c3e8d51154f88d5033
SHA512 7b3e7133089af12aef7fda325a17e955ead1c3928d60dea08813e287bcf5483c06a28058314426cc0484ada7ab8dc11d287c36faad27b34ce0f1edd576d8429a

F:\$RECYCLE.BIN\S-1-5-21-778096762-2241304387-192235952-1000\CCCCCCCCCCC

MD5 3928517b6be2d032a287bae809b39311
SHA1 1408d23851b4906fa86b52e71ea5131a056877a2
SHA256 a54fffefac9873e6ecb9fe9478afef1fef7e130848da68eb483640fb570a6661
SHA512 28502eff259980c79ed2272b879664380d5f5b5cccc55472e709b069b3924280180d71c53051bced7d920d804637e0c3a66f09cdcf0f4dfffc3f60faa50fac08

C:\j3ncKbrq7.README.txt

MD5 3f38195a47b5f3eea6814f887d10a9ea
SHA1 60991392ee9c025c5602f6ee88f0937c58c16cf0
SHA256 dccea726e9b48b399779440dd565fa986d36ba9dcd132277a727c95dde2c4caa
SHA512 df653cdd375bea8ce2ef4104c18ca08e55ff14e7a8f554ac76297032d6dba8e724a45f0128497ea90f5b1007d0c06c7451e1773a1896bf67e41d7507f5b57cea

\ProgramData\AAA1.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/2760-832-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

memory/2760-833-0x0000000000260000-0x00000000002A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 6ead5fa98dff59480b4e2202ec37c9e1
SHA1 a143e8d80a6c98c5c2c3f1403e9689f98e66711d
SHA256 926d23112e3e31ab372b11ebb47be53f821164e15541aac8813e6250bb0da2fa
SHA512 77d9eea5b4df7cb3cca18bfcc8087eabe812e8dcfea5c7f23d794a717f5a3d111649117742975deccbee6dfc8bebe524fa3a96e830326c1ea1320e64babcfde9

memory/2760-839-0x0000000000260000-0x00000000002A0000-memory.dmp

memory/2760-842-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2760-843-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2760-866-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/2760-865-0x000000007EF40000-0x000000007EF41000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-14 04:21

Reported

2024-03-14 04:24

Platform

win10v2004-20240226-en

Max time kernel

147s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe"

Signatures

Lockbit

ransomware lockbit

Renames multiple (600) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPnxl31yh2q05hk7f01a3_nanl.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPyspk9kicu0xk2x95yy9xiylub.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPzy6hx3k_ck0xpl5ny1s59pcfb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.j3ncKbrq7 C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.j3ncKbrq7\ = "j3ncKbrq7" C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7 C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\j3ncKbrq7\DefaultIcon\ = "C:\\ProgramData\\j3ncKbrq7.ico" C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe

"C:\Users\Admin\AppData\Local\Temp\ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 104.241.123.92.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 174.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 42.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 176.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

memory/4884-0-0x0000000003180000-0x0000000003190000-memory.dmp

memory/4884-1-0x0000000003180000-0x0000000003190000-memory.dmp

memory/4884-2-0x0000000003180000-0x0000000003190000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2727153400-192325109-1870347593-1000\desktop.ini

MD5 b972f9d15fb3736233a5deaad36cc717
SHA1 bbe877e76cbefe77201f9aa5881de50bb14c6273
SHA256 5a4e54fad1b51382ad8435af8e5c82f1d23b0c80c15ad766ccd32a55867f781e
SHA512 8b9db97b9bfd5ad008e0c7e7d01c3fcecadc0255110bedbb7f645d7d771efbfddc5ad4ebc99acee28a2da2f28bafde6a636be83e2ad1e3e7bc81c8c23044bb30

F:\$RECYCLE.BIN\S-1-5-21-2727153400-192325109-1870347593-1000\DDDDDDDDDDD

MD5 b5b2736405e53f77f98ce21a1e58c8a3
SHA1 022a7a25e10fc3a218a743b2d846534116ecfb00
SHA256 2452e85e8bae91eebfa0eb2a149a238262f8d679008b910a2021f8c83a41de48
SHA512 062ba61ecce4f2d8695742ba8d6c29688678b5da7f53a1448f98a4f21d110d6736651bf2608c08f4b4b5a9c33363017908b41460f1fe667e2e56df41a8a97f3f

C:\j3ncKbrq7.README.txt

MD5 f964d56bc1e004a0faf927e047194535
SHA1 bc35bae6defe3d1e49b4e16c9f601e7a5cc8eb2e
SHA256 e7c7cadd331c672d2f03f784d431980221051cda1abe860b637d7e8ada7a1e61
SHA512 24f318f175b90fb1f9644d5becce7ade996003c7bf6ebe675f191694c6e537f29481e511f64769cb405c7a2edf14123984946488eb52a1daf24a9ec9d580a56d

memory/4884-2734-0x0000000003180000-0x0000000003190000-memory.dmp

memory/4884-2735-0x0000000003180000-0x0000000003190000-memory.dmp

memory/4884-2736-0x0000000003180000-0x0000000003190000-memory.dmp