Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 04:23
Behavioral task
behavioral1
Sample
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe
Resource
win10v2004-20240226-en
General
-
Target
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe
-
Size
159KB
-
MD5
49bc004433997ad9fb6d0e42dcb1b020
-
SHA1
fbbfc40f0a0493794698680a4bd0c4b6fb6b4f1e
-
SHA256
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1
-
SHA512
d5220c3160baa46d8568d3338a40fee24b7fbd6561690f225ddd47d556086e441e46ce26104348cf66d424b9b55a0f9d1d556e08336f074c2177c7060b56e09b
-
SSDEEP
3072:PuJ9OlKolUa1U197bzhVsmftsRUsIxX4sbqcQL8AX2jKl3j:Pufj0zi1dNVsmftjs8PbqMji3j
Malware Config
Extracted
C:\Users\dB6AsqMxo.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
Processes:
8EBF.tmppid process 4064 8EBF.tmp -
Executes dropped EXE 1 IoCs
Processes:
8EBF.tmppid process 4064 8EBF.tmp -
Drops desktop.ini file(s) 2 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-513485977-2495024337-1260977654-1000\desktop.ini deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe -
Drops file in System32 directory 4 IoCs
Processes:
printfilterpipelinesvc.exesplwow64.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\PP444ebjx41l_93vkmboaa9wtxb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP50ddpk06l2fu50mgoli392fde.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPnkn9rxa_tv9983s5pzw43uclb.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\dB6AsqMxo.bmp" deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\dB6AsqMxo.bmp" deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe8EBF.tmppid process 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\Desktop\WallpaperStyle = "10" deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe -
Modifies registry class 5 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dB6AsqMxo\DefaultIcon\ = "C:\\ProgramData\\dB6AsqMxo.ico" deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dB6AsqMxo deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dB6AsqMxo\ = "dB6AsqMxo" deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dB6AsqMxo\DefaultIcon deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dB6AsqMxo deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exeONENOTE.EXEpid process 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 3984 ONENOTE.EXE 3984 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
8EBF.tmppid process 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp 4064 8EBF.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exedescription pid process Token: SeAssignPrimaryTokenPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeDebugPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: 36 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeImpersonatePrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeIncBasePriorityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeIncreaseQuotaPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: 33 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeManageVolumePrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeProfSingleProcessPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeRestorePrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSystemProfilePrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeTakeOwnershipPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeShutdownPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeDebugPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeBackupPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe Token: SeSecurityPrivilege 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid process 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE 3984 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exeprintfilterpipelinesvc.exedescription pid process target process PID 4264 wrote to memory of 560 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe splwow64.exe PID 4264 wrote to memory of 560 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe splwow64.exe PID 3964 wrote to memory of 3984 3964 printfilterpipelinesvc.exe ONENOTE.EXE PID 3964 wrote to memory of 3984 3964 printfilterpipelinesvc.exe ONENOTE.EXE PID 4264 wrote to memory of 4064 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 8EBF.tmp PID 4264 wrote to memory of 4064 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 8EBF.tmp PID 4264 wrote to memory of 4064 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 8EBF.tmp PID 4264 wrote to memory of 4064 4264 deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe 8EBF.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe"C:\Users\Admin\AppData\Local\Temp\deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:560 -
C:\ProgramData\8EBF.tmp"C:\ProgramData\8EBF.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
PID:4064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1532
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{2B24E8E7-94B3-436F-964F-255EDE9522C7}.xps" 1335486387186200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55a832a3d8ed988f34c5c8cac5885cc06
SHA1387e9cb1572cb10f2415e3d6b1614208e6de1213
SHA2567937e7194a8c13105c96e266012dc2741bdf772590bb6492a1249c4f42e3902d
SHA51257e976c772d5ff91a5901562541f0299cfb9f0a531f93a1c29015f9c8bb66a84f400f6ef717330124708d405714f4049ddec8fda2ad194f503d7f3cf09b32005
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD546e29394ea643917d80787e341db47fd
SHA19e921fd45948d588203cee46b78cf944984785d8
SHA2562cc834701fba67daeb94b43f3398b76f8a1531a880483d454eef941631626018
SHA5126941f013f963d7105cfad0e09f0123feeb87f24248a24067222e90c76ade61b4761f28df79d9786f644cf06d358bbec969df52e23cbcf2af7ee6340f7bdd79ca
-
Filesize
4KB
MD5b4b43b7229dbba72ad845b8834ec28c1
SHA1981eae4c6288500416076bd41ef915ff2a67f2bb
SHA256ad7f2109cfb0099a85358cdac900c7593c1add3bdc52190f888faaadca3f42a6
SHA512be1436f2cd973b31e28faea434fa7e4b1c11903b11ffe8367f5923535c323cdd863b5380bb9dd1e1efbd0a9ef084cce3187bb17501aed6e9473df92204de8a68
-
Filesize
10KB
MD5316bef2d0f08378eeeef596836beac49
SHA123c4489a2ccf7e8edf98a226b18a222c0dc52d86
SHA256d5ba85621e3d712d6cfcd827ea5d86f46b18471ea2fa9eba903d5f57a0764821
SHA512be1f9181325a7bb89f11142cd06da7ea6286d9f4ad64b64851bbd56ad26544f5bcf607a213628e94ed812604b67bf3b06507410d25f1a7277398adea34e79b21
-
Filesize
129B
MD50055347be81388e6e77024dc1d641a8b
SHA1bfb6a0777cdb5f568fc808bf0709bc996a3e6771
SHA256d986a0aa1e3abd091817490a37a608de4e37c1145a0e759d6f72676c81a1f1f5
SHA512b25812698e0e7df180fd44fdbca000baf43a209312da0d2d3e7cf2663fb55526930d8dbdb6e74e5b025bb881e420371f5699aa82a49c46c4bed9e685e6053d20