Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/04/2024, 15:19
Behavioral task
behavioral1
Sample
a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe
Resource
win11-20240419-en
windows11-21h2-x64
18 signatures
150 seconds
General
-
Target
a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe
-
Size
194KB
-
MD5
e990e7571cdb06c5d0f093176cecf414
-
SHA1
409fc0816adbf05ac1586112044401ecb90c8022
-
SHA256
a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616
-
SHA512
9719fb45a0cd79ba8d51c3d052fe76dcb6d1b5b677a5398cc4fdbe6373d8763d2b0c3375929f41c5a0e46237b4a3f660b0b7f6a4f8a24ea47d52074da69baa64
-
SSDEEP
3072:A6glyuxE4GsUPnliByocWepzdBaChENI/NBpke:A6gDBGpvEByocWelq+V
Score
9/10
Malware Config
Signatures
-
Renames multiple (536) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1672 95B9.tmp -
Executes dropped EXE 1 IoCs
pid Process 1672 95B9.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-293923083-2364846840-4256557006-1000\desktop.ini a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-293923083-2364846840-4256557006-1000\desktop.ini a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP0ssjmv97c1xsw7qp_01vj80ac.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPx069t08or7d9auz73m0slmh.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPtkd08bxaojw7r90l30ik8aknc.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\MIuB4Jpci.bmp" a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Set value (str) \REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\MIuB4Jpci.bmp" a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 1672 95B9.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Control Panel\Desktop a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Set value (str) \REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Control Panel\Desktop\WallpaperStyle = "10" a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.MIuB4Jpci a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.MIuB4Jpci\ = "MIuB4Jpci" a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIuB4Jpci\DefaultIcon a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIuB4Jpci a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIuB4Jpci\DefaultIcon\ = "C:\\ProgramData\\MIuB4Jpci.ico" a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp 1672 95B9.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeDebugPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: 36 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeImpersonatePrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeIncBasePriorityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeIncreaseQuotaPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: 33 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeManageVolumePrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeProfSingleProcessPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeRestorePrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSystemProfilePrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeTakeOwnershipPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeShutdownPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeDebugPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeBackupPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe Token: SeSecurityPrivilege 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE 1708 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4368 wrote to memory of 2644 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 82 PID 4368 wrote to memory of 2644 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 82 PID 1608 wrote to memory of 1708 1608 printfilterpipelinesvc.exe 85 PID 1608 wrote to memory of 1708 1608 printfilterpipelinesvc.exe 85 PID 4368 wrote to memory of 1672 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 86 PID 4368 wrote to memory of 1672 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 86 PID 4368 wrote to memory of 1672 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 86 PID 4368 wrote to memory of 1672 4368 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe 86 PID 1672 wrote to memory of 4384 1672 95B9.tmp 87 PID 1672 wrote to memory of 4384 1672 95B9.tmp 87 PID 1672 wrote to memory of 4384 1672 95B9.tmp 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe"C:\Users\Admin\AppData\Local\Temp\a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2644
-
-
C:\ProgramData\95B9.tmp"C:\ProgramData\95B9.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\95B9.tmp >> NUL3⤵PID:4384
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1536
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{759867E6-0530-41F7-8AF5-EB46392AF5EF}.xps" 1335887758124200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD58b94f6804e988b79c5e9fa3869f5ed07
SHA18148fdbb9b08a6868f9acd456a65adf680e7f545
SHA25604eee98c0fb471bd651b72e40f48d9a6a83f7b9b6382f24dd626f355958f5cb8
SHA512defdf196fad23a7fd4ca0d4e8f341f7ede89cc5335d2ef1583e1d1c9195d167606701940d9448bdd96d5d4945176143e90a35fa4cb7ab63c991a29c31deffa7c
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize194KB
MD5a95319be7e3639b369b22086d344305f
SHA1f01c1cbf16082978b7e014e7f65f9b95480c2c38
SHA256d8cd19e363a3ed371e8e2f3000416ef866e8bcf3041bae6c923bb52db5306282
SHA5128bb3f7d753bb260e41c20df943f11fc1ac7ddbd4b6a830adff549d26fe44d3540ad2bac5d45b9ab79740d951edadf136a9bdb660a1d8ff8199a2692252e60f25
-
Filesize
4KB
MD5924cc38c06d56fe0ee3a0a424799cd81
SHA1d251ce02e672f69b58eff4452a0574bfdc13c170
SHA256307e55e0c4cde1980e2d76bd292409a16da4fae7c2b5112a4850f859657bf832
SHA512cce2d1450b97f51d6499aa8f5c991fa5a9455567d73e8844e3b42a58dad4223cb71f559dd569a3e7832f619550ae72ae6e2567d40d5ccbf5b88f314545e61bd6
-
Filesize
434B
MD5b4709a56b9d7f431da172316cda720be
SHA1d2132f7129a7003ec4c0392f0f08cd24ea353da6
SHA256192d1e6078570865531e8a4c9840a483c4a2ac35fe468107284991f6da813191
SHA512e390d51e95db5e56c666a2895dc87dab41d97e7ce3c0df1f2466abf14a651167232521ab5f52746d16bab0ef14e6c0ee9dcfe29894604d695b0d064909378227
-
Filesize
129B
MD53289aec62300aa1bdc6cf909e4101bbd
SHA1f233b63567c1232782894af035850c3098314f0a
SHA256caf2651b72b44e0d18b0c848d391b540a250ff09c5066cf347aea764263db41b
SHA512063c3e7ca6c530874e45b4ff5761eb5012ab201e1bad956bbae7d4b81759756262f33d9b6acc01aa3fcde6f46d9f58ef3eb95ff4bd5d40d205c2f67e6017f2bc