Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 12:48
Behavioral task
behavioral1
Sample
d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe
-
Size
146KB
-
MD5
9a2e880c5c4fcbecf71014de4bbeb2db
-
SHA1
173089f18ef521b89516319117bf545d33f2e657
-
SHA256
d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418
-
SHA512
c01ee3e7898b6dda26aee4d04c4a345d2c36ba019bade775dd71330d96a37ed0594a496df18db3a2e593fd7e13f90de123f47ab33e3a8d4936501c69e7500a59
-
SSDEEP
3072:m6glyuxE4GsUPnliByocWepc8HtoTc0U7DF:m6gDBGpvEByocWeFNh0GDF
Score
9/10
Malware Config
Signatures
-
Renames multiple (578) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation E62B.tmp -
Deletes itself 1 IoCs
pid Process 1404 E62B.tmp -
Executes dropped EXE 1 IoCs
pid Process 1404 E62B.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-4092317236-2027488869-1227795436-1000\desktop.ini d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4092317236-2027488869-1227795436-1000\desktop.ini d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPo4m7bxoiw9llsjd7pjl0w98cd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPhb_5n1n2h0gmt8caqs7hos0w.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPcjq28puwfda7qfxf2y1zey8kb.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ETx6kDWq1.bmp" d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Set value (str) \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ETx6kDWq1.bmp" d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1404 E62B.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\Desktop d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Set value (str) \REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\Desktop\WallpaperStyle = "10" d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ETx6kDWq1 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ETx6kDWq1\ = "ETx6kDWq1" d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ETx6kDWq1\DefaultIcon d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ETx6kDWq1 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ETx6kDWq1\DefaultIcon\ = "C:\\ProgramData\\ETx6kDWq1.ico" d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp 1404 E62B.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeDebugPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: 36 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeImpersonatePrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeIncBasePriorityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeIncreaseQuotaPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: 33 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeManageVolumePrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeProfSingleProcessPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeRestorePrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSystemProfilePrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeTakeOwnershipPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeShutdownPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeDebugPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeBackupPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe Token: SeSecurityPrivilege 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE 2680 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1752 wrote to memory of 4636 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 91 PID 1752 wrote to memory of 4636 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 91 PID 2908 wrote to memory of 2680 2908 printfilterpipelinesvc.exe 97 PID 2908 wrote to memory of 2680 2908 printfilterpipelinesvc.exe 97 PID 1752 wrote to memory of 1404 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 98 PID 1752 wrote to memory of 1404 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 98 PID 1752 wrote to memory of 1404 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 98 PID 1752 wrote to memory of 1404 1752 d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe 98 PID 1404 wrote to memory of 2136 1404 E62B.tmp 99 PID 1404 wrote to memory of 2136 1404 E62B.tmp 99 PID 1404 wrote to memory of 2136 1404 E62B.tmp 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe"C:\Users\Admin\AppData\Local\Temp\d5d49fbe4f955416afe5db8c735638cedde326347757e8c57323305480568418.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4636
-
-
C:\ProgramData\E62B.tmp"C:\ProgramData\E62B.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E62B.tmp >> NUL3⤵PID:2136
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3492
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{34FDE610-21E7-4322-B903-B1770CDB875F}.xps" 1335783171732000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5c66ba73809200df3907667334aa23aba
SHA18ee6b11f4a6433f51763d5674ff7951fd9702e6e
SHA256b1e7ae1d566118d2faa471aa536b7ebf5a6eb750cde14a5d953afa97c6cfedbd
SHA51226ad52e258f7d00230d99bef4b12fdb597f601fe7b93eb853fd36018af28a4ea1496217b359518f480fa6de63a3248fab1c8d26e0fc9e4d21feae5e2b68709f6
-
Filesize
449B
MD5766ef24b15ffcc364d7a2e8fbe56322a
SHA1b333f4e3333fbd2a28b112e3854a083a161ab627
SHA256fcd9314182e1d6ce85e724ed58f2add5993982f52459af9b0198095be137e0af
SHA5129a0a23398ee072008bd7fd7ff31e3dc0b1737a0cd101da12e6879ed41fb9eba30829cbb52bd654c52aca2fe4afd01278da5f440da9b940e8a6775f25a01bd553
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
Filesize146KB
MD565f93e64cd79f255cd7983272a92043c
SHA1a353927bb6ff8b00e995b39ae52282850c8febf8
SHA2562b68580b58fa179fac240869203b5b42383e157734034df554d172654625d5ee
SHA5126ac22b39261a7e1852aecc384f939dd127e7a14e4c246b27ad4fa6a04ebc9d4a7198972ef4fb54cb611e6ba1a7a937d648713fbfc0013d57d3cb21fa818e025c
-
Filesize
4KB
MD5f58179a5575d6e2b5f9cd43866fd5e7a
SHA1610980d67f2e5f48fbbf69c366fbf03886782e1d
SHA25671cce039ee9c454300bc22628cfdc1db571086f4bda8af312ee6f44cb05c0976
SHA512e7be542cc5d736828ddbea3daaac75f30063c15f23df5f709f331d131855663595e74b9f74580affe8b7d78b236bb88422196642d640a65b613d40acc41dcf6c
-
Filesize
129B
MD542389d43c377e104c66cbd7eb6377e8b
SHA152c488468a379c0824c278ad4c5c372f5f14a791
SHA25651b03b67acc16b04cc8656e8661d8b3ce90f6d71f8e4e3007217d3ed5ffdcd7d
SHA5121a2a87daf0dd0a3001cdf3ef1f668cb1937b010429f4db3df02be48630249c6fedc441d9ec504ffc6adfa920005863432e358abf397bb6ff248d7380adc8d3c0