Analysis
-
max time kernel
52s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:22
Behavioral task
behavioral1
Sample
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe
-
Size
159KB
-
MD5
85ca694de55c02d285e997e7671c9e43
-
SHA1
e4ecabeb1f0df4ae69a9408d6522f039fd3a4968
-
SHA256
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3
-
SHA512
6bea0a189a947c059205e8c31dbcc0f6675504170d4dade3d780ab20fd44b1e1ae4b4d975227d95fd08a9aec3adeec21ce471a095650a53304837f12f515f4ca
-
SSDEEP
3072:/uJ9OlKolUa1U197bzhVsmftsfwohznCoJjlNr/DNg10:/ufj0zi1dNVsmft0GoJzrK0
Malware Config
Extracted
C:\5XKuA1aj2.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
Processes:
6487.tmppid process 2576 6487.tmp -
Executes dropped EXE 1 IoCs
Processes:
6487.tmppid process 2576 6487.tmp -
Drops desktop.ini file(s) 2 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP0idlia_hiscq0ba0swddv2qf.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPupdb7vn3n0s5pvz7myk22s6qc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP06gs6o4727l7eblba70uk07f.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\5XKuA1aj2.bmp" d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\5XKuA1aj2.bmp" d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe6487.tmppid process 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallpaperStyle = "10" d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe -
Modifies registry class 5 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5XKuA1aj2\DefaultIcon d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\5XKuA1aj2 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\5XKuA1aj2\DefaultIcon\ = "C:\\ProgramData\\5XKuA1aj2.ico" d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.5XKuA1aj2 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.5XKuA1aj2\ = "5XKuA1aj2" d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exeONENOTE.EXEpid process 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 2384 ONENOTE.EXE 2384 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
6487.tmppid process 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp 2576 6487.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeDebugPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: 36 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeImpersonatePrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeIncBasePriorityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeIncreaseQuotaPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: 33 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeManageVolumePrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeProfSingleProcessPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeRestorePrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSystemProfilePrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeTakeOwnershipPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeShutdownPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeDebugPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeBackupPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe Token: SeSecurityPrivilege 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid process 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE 2384 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exeprintfilterpipelinesvc.exedescription pid process target process PID 2292 wrote to memory of 4576 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe splwow64.exe PID 2292 wrote to memory of 4576 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe splwow64.exe PID 4932 wrote to memory of 2384 4932 printfilterpipelinesvc.exe ONENOTE.EXE PID 4932 wrote to memory of 2384 4932 printfilterpipelinesvc.exe ONENOTE.EXE PID 2292 wrote to memory of 2576 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 6487.tmp PID 2292 wrote to memory of 2576 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 6487.tmp PID 2292 wrote to memory of 2576 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 6487.tmp PID 2292 wrote to memory of 2576 2292 d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe 6487.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe"C:\Users\Admin\AppData\Local\Temp\d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4576 -
C:\ProgramData\6487.tmp"C:\ProgramData\6487.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3688
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{23738028-18A8-4E52-A1AF-CDA83EF1C42A}.xps" 1335486378393300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD58ad5e7ff7f2bb928da81c8bda768d397
SHA1c22a8cba345936279979312a39c51cd673d30f8c
SHA256a03da6840ad8937f43354423804cc2b13b1477b16eed7a888a33fafd13d061b1
SHA512fd64daeac28f8df65ec644bbb85cb48a3b8c8f073eac6470a0c8fd545dcc74978f193e4c857710cdc4fb8784329ca7a20627b72dfa5f6424c624767a42ecc890
-
Filesize
10KB
MD529925258b83173f167ede9942f48e672
SHA1985c6408bd9e1ebc10d1fb1182f48c80106aaa92
SHA256a30efdf638e4b2fe1ffc862daefa88ebc1002032bca9be7495a18689464e3f49
SHA5120c55e8fe514a1ffa1256d9d350b34cd50ca0313b8706b172e4698d1bf4bdff6d9968bf3e876635b7d9e1c9733a0ec7f7befb99f980d9574dc27734d8b232ff00
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD5f43e9a5bf8c59fa9ee85150978c619db
SHA182f3146b81e69a9af474a881a86ee6cfd0d9c8ef
SHA25606a866d6ac3ca414b84eb039e00cc76183f66f09f9ee1b97fb946b244885a5d9
SHA512aa4b35ef38f459c037e0816e018332429308316869659c21f2ea0942588dd1630413d931123506bdaaf0aa1aed454cf69c3d180149ab0c4aef6525b2a23a4408
-
Filesize
4KB
MD592c8184bcd56a42b7ac6aa9c305f9457
SHA1b3e1a168cd7c77ae58e5741bed116b325670de47
SHA25664057236aba233f7e7272d726b2dedc1cddaf5960088cca00b74f6411f320db6
SHA512192168f9f7753b5c1cbef4087ba55979c62dc77d34bfb8978bdd0d05fa5dce8df152dd3c6771fbb44e9a3b3e8b3b4c53310b888e3d15c0e56cb27e8b47a3d397
-
Filesize
129B
MD5e590007a35ed85a70c45d5b831f590fa
SHA11682685f7e4795c88d4f9d97b29d78190baf3853
SHA256bc568b89da40ad530927f0418d203f9021cb1b35a21401991a2e43db9cf7763b
SHA51231bb5bd933b35a740bf37fbe1edec5d898e369c3a812279715d26bf991e569caca8fe942c79fff631b610a117f0c542a8dcebd93684b0e9a847aefa7c09f7e63