Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe
Resource
win7-20240220-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe
- Size 352KB
- Sample240530-lyf9aaef24
- SHA256 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416
- MD5 528f6a10f082f1fddd96c1d4f0bfce95
- SHA1 bf2336177611e605410f61cbbf5a3deb2d186f3e
- SHA512 e013cdfcf443cf174d3b0319b77f989119f2be29b0e14a09022216e410485e909801cc26c07b076ef620444bc987a8ab327165d279a067b53efe24fa66533a66
- SSDEEP 6144:B/3Uddl5Imn5crCyRKqUeyo3NczQgcTq4jpqMhBrq:B8ddl5Im5cg+yo3a81Hhhq
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\wKTiyscK2.README.txt
Ransom Note
- To recover your encrypted data, you must purchase a decryptor from us. We accept XMR (Monero) or BTC (Bitcoins) cryptocurrencies. XMR payment must be sent to: 8AP3aG4nxR3gka11FEDnJGftEyJkQLTVEQjPgrzkh2JU9u6KZYtLdn9eQynn1ogJgUhPBHVp6UoWANgETHK9wHUtQHLcSAa BTC payment must be sent to: 14hsKjR7L2KNmPpzeoXtNB8C2AuBL5Ch88 If you pay within 3 hours, then you only have to pay either 5 XMR or 0.1 BTC. If you pay within 6 hours, then you only have to pay either 15 XMR or 0.3 BTC. If you pay within 12 hours, then you only have to pay either 45 XMR or 0.9 BTC. If you pay within 24 hours, then you only have to pay either 135 XMR or 2.7 BTC. If you pay within 48 hours, then you must pay either 405 XMR or 8.1 BTC. If you pay within 96 hours, then you must pay either 1215 XMR or 24.3 BTC. After 96 hours you cannot recover your data. If you cooperate with us, then you will recover your data. If you delete or alter your files, or if you attempt to recover the data yourself, then your data will be lost forever. The decryptor won't work if you modify anything. To receive the decryptor to recover your data, carefully follow these instructions: 1. Send XMR to 8AP3aG4nxR3gka11FEDnJGftEyJkQLTVEQjPgrzkh2JU9u6KZYtLdn9eQynn1ogJgUhPBHVp6UoWANgETHK9wHUtQHLcSAa 2. Pay in full. Any lesser amount will be ignored. Copy and paste the XMR address. Do not type it by hand. 3. Email us at [email protected] 4. Include the TXID and TXKEY of your payment at the beginning of your email. So we know it is from you. Emails without this info will be ignored. 5. Plain text only. Any attachments, links, javascript, or other fingerprinting will be blocked and ignored, and we will not send the decryptor. 6. Please be patient. We check email often but not every second. Using your normal email will expedite your recovery. 7. If our email is broken, bounces back, or is compromised, then you may instead email us at: [email protected] 8. After 1 confirmation on the blockchain, of the correct amount according to the timetable, only then will we reply with the decryptor. 9. You may need to check your spam folder for our reply. The decryptor will include instructions how to fully recover your data. If you are too stupid to use XMR, then you may instead pay with Bitcoins. Bitcoins may be sent to: 14hsKjR7L2KNmPpzeoXtNB8C2AuBL5Ch88 Please include your BTC TxID in your email and a very brief explanation why you're stupid. If you are too stupid to understand that your data are gone forever, unless you pay, then not even a decryptor can help you. If you are smart enough to understand why you're racing and whom you're racing against, then tell us in your email. If correct, then we will fully refund your XMR or BTC when we send the decryptor. We don't think you're smart enough to understand why you're racing, but we hope to be surprised. WE WILL NOT REPLY UNTIL PAYMENT IS RECEIVED. WE WILL NOT SEND THE DECRYPTOR IF YOU ATTEMPT TO IDENTIFY US OR STOP US IN ANY WAY. IF YOU COMPLY AND PAY, YOUR DATA CAN BE RECOVERED IN LESS THAN A DAY. IF YOU HAVE BACKUPS AND ARE UNAFFECTED BY THIS RACE, THEN YOU ALREADY WON.
Wallets
-
14hsKjR7L2KNmPpzeoXtNB8C2AuBL5Ch88
Signatures
- Renames multiple (626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation E079.tmp - Deletes itself 1 IoCs
pid Process 2452 E079.tmp - Executes dropped EXE 1 IoCs
pid Process 2452 E079.tmp - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP6p07u0uhuuoppifp3zf710ckb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP3y1r5ibmnd72nmv7fa4jxt1oc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPmfnyot2kaa1r1xd29kz7nkgec.TMP printfilterpipelinesvc.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\wKTiyscK2.bmp" f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\wKTiyscK2.bmp" f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2452 E079.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE - Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\WallpaperStyle = "10" f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wKTiyscK2 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wKTiyscK2\ = "wKTiyscK2" f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wKTiyscK2\DefaultIcon f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\wKTiyscK2 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\wKTiyscK2\DefaultIcon\ = "C:\\ProgramData\\wKTiyscK2.ico" f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp 2452 E079.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeDebugPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: 36 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeImpersonatePrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeIncBasePriorityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeIncreaseQuotaPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: 33 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeManageVolumePrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeProfSingleProcessPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeRestorePrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSystemProfilePrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeTakeOwnershipPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeShutdownPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeDebugPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeBackupPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe Token: SeSecurityPrivilege 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE 1048 ONENOTE.EXE - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 648 wrote to memory of 3536 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 100 PID 648 wrote to memory of 3536 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 100 PID 1280 wrote to memory of 1048 1280 printfilterpipelinesvc.exe 103 PID 1280 wrote to memory of 1048 1280 printfilterpipelinesvc.exe 103 PID 648 wrote to memory of 2452 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 104 PID 648 wrote to memory of 2452 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 104 PID 648 wrote to memory of 2452 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 104 PID 648 wrote to memory of 2452 648 f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe 104 PID 2452 wrote to memory of 4396 2452 E079.tmp 105 PID 2452 wrote to memory of 4396 2452 E079.tmp 105 PID 2452 wrote to memory of 4396 2452 E079.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe"C:\Users\Admin\AppData\Local\Temp\f9b0a14a2070d1aa76598960a7ff4e1da637aa3ac37a73eecfb63bed95a0b416.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3536
-
-
C:\ProgramData\E079.tmp"C:\ProgramData\E079.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\E079.tmp >> NUL3⤵PID:4396
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:4120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1444
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{5296DFA1-D57D-4324-BC89-8EE205B8289F}.xps" 1336153663678400002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\CCCCCCCCCCC
- Size 129B
- SHA256 bc3583b07c7b8dd8663ccc105fe919da7d0d747d8947c1b9290b0572ce047fbb
- MD5 22e59111e4284eacafe83e8401040974
- SHA1 0bf5eb5cc598e33d203f7e2b94ee794a9d9943f4
- SHA512 1c6c5de80acbf4abb84642963d62f1d8db630c61a04fe4b6c5860b31d32b0a74e5bbe94be010a4bbd0f5083e7bb323c76589c134cbd6a839e4a8b1b48b4aa877
- MD5 SHA1 SHA512
- Path C:\ProgramData\E079.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
- Size 352KB
- SHA256 f85468476e5fd20ea854128f7d727d9410f476bcb01324921849cb88c53df105
- MD5 72d0f3d3793b50454d513f9212f9a563
- SHA1 f0acdca68685adbdd32153d33b22e07380a781e0
- SHA512 ed0ca95eefe97e2201a3621ba01f9367a52e72b6d92081c4956eccf42e10f3fefda00406aa49ac98bf90153edebf604034dcb063d80c05a5515aa02f841b12de
- SSDEEP 6144:0C/6W3sos+Kti3WItJC/6W3sos+Kti3WItJC/6W3sos+Kti3WItJC/6W3sos+KtJ:0C/6W8osidtJC/6W8osidtJC/6W8osin
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{415B28F2-DB34-4D21-8975-5EC4E9F6255C}
- Size 4KB
- SHA256 46dc64d5c486aab62db1bb316193ee26b559aebb51051fe0b8eecb502db9fba4
- MD5 ff9ef410f4aa47a6741ef515ad7dfcb7
- SHA1 e6a4fbe6909d0e5247135bc9c58b241764f4d77e
- SHA512 5b96211fbee7de8336915ac643709dde9d64ae38d94b56b09a1c85d6191a26c868b637db828673d56811f4290ef59c8535f3e80b9a7874b62b0e271a7afcca0e
- SSDEEP 6:RaZfjYyfB3h1RRXUnfthfrcTlFKIaEuAEbRujlw//0lweI/UAEBRujd:RaNjYyf9/UfHMpujEWf/Ujs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
- Size 4KB
- SHA256 71e556a9259ee73781c7885b3bde0d1bee0c7210fec0e3f08d9196d8949321d2
- MD5 7278b34397e9083644a4df80eef15bee
- SHA1 18b16402031e76e70c525e98676cb60a2b946a5f
- SHA512 bf50c32d67b76f445f64cc3ceaee6305a3a5117ed3fb8de1191d7543ea1f3a1129e30d3f7bdb638f05631f5dc87c6f12b5551b7f41146dee1f6328f265c2bddf
- SSDEEP 12:RaNjYyfHj/Uv8YMpujEW6/UjB60AEr/hlaEIxA/L:YNjYyfHY0YMpsE8B6fENw1Aj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\wKTiyscK2.README.txt
- Size 3KB
- SHA256 2d852c14216da672726944ab517ad206413343af9cbd0cb0e035e0689a3c9362
- MD5 892efc7e09681c42b36b2fe98c290bb9
- SHA1 804e40761e6a48268ab4365abb1866a8984ffee7
- SHA512 83da941bf64a9a4036034d85d0385113ffac517e906ae799fa45a3e15dd32c81120b80db9e1398a93c01d2ed2c8a27e8e6c2832c21bfb1490a3b144c35272218
- MD5 SHA1 SHA512
- Path F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\DDDDDDDDDDD
- Size 129B
- SHA256 bcde5ef584ecd2a8e12e7d40b8f404b3bbbac2abb90e6605e276196db5c32184
- MD5 423f652ffb91f0fa895f6219524f2275
- SHA1 789526afc4245dd0d104b686d96e4c3fe81f68b2
- SHA512 b36ba83f7019f3ef82984fa8ea6fb2d4a9bd084e5d747b6496b333f5db9e09fa45d7931334ad25ded32869d052ee77032513fa304e7b95f283e756a350dc40c0
- MD5 SHA1 SHA512