Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 09:36
Static task
static1
Behavioral task
behavioral1
Sample
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe
Resource
win10v2004-20240508-en
General
-
Target
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe
-
Size
362KB
-
MD5
7e064da559216f888c487648ab6d0047
-
SHA1
54725179097947199b249b8deef4565e73151603
-
SHA256
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388
-
SHA512
89a6f380e2ee7eab04b8a087d168d320dbfca3a50253eb2f1fcc264517ca19e1a376cada60f5274151a84c695577805ba0fa8f0e6ef9e2079e11f27a45763932
-
SSDEEP
6144:1N9JuegRZ+Rpbe3xwvG854HhNOP+msxvElWGQLajLjXg+Bdx6vHGBl/+n:1Ev+RteMGzNOUdGQLoLjXnDxAiQ
Malware Config
Extracted
C:\Users\yoxe0MdFZ.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
Processes:
2A7A.tmppid Process 2444 2A7A.tmp -
Executes dropped EXE 1 IoCs
Processes:
2A7A.tmppid Process 2444 2A7A.tmp -
Loads dropped DLL 1 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exepid Process 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\yoxe0MdFZ.bmp" 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\yoxe0MdFZ.bmp" 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe2A7A.tmppid Process 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2444 2A7A.tmp -
Modifies Control Panel 2 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\WallpaperStyle = "10" 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe -
Modifies registry class 5 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\yoxe0MdFZ 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\yoxe0MdFZ\DefaultIcon\ = "C:\\ProgramData\\yoxe0MdFZ.ico" 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.yoxe0MdFZ 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.yoxe0MdFZ\ = "yoxe0MdFZ" 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\yoxe0MdFZ\DefaultIcon 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exepid Process 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
2A7A.tmppid Process 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp 2444 2A7A.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeDebugPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: 36 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeImpersonatePrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeIncBasePriorityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeIncreaseQuotaPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: 33 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeManageVolumePrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeProfSingleProcessPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeRestorePrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSystemProfilePrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeTakeOwnershipPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeShutdownPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeDebugPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeBackupPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe Token: SeSecurityPrivilege 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe2A7A.tmpdescription pid Process procid_target PID 2416 wrote to memory of 2444 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 30 PID 2416 wrote to memory of 2444 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 30 PID 2416 wrote to memory of 2444 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 30 PID 2416 wrote to memory of 2444 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 30 PID 2416 wrote to memory of 2444 2416 9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe 30 PID 2444 wrote to memory of 2624 2444 2A7A.tmp 31 PID 2444 wrote to memory of 2624 2444 2A7A.tmp 31 PID 2444 wrote to memory of 2624 2444 2A7A.tmp 31 PID 2444 wrote to memory of 2624 2444 2A7A.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe"C:\Users\Admin\AppData\Local\Temp\9a5e9e472e27302d1268777726659f64ed9f0d9061877cd6dda1d31eb8ed6388.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\ProgramData\2A7A.tmp"C:\ProgramData\2A7A.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\2A7A.tmp >> NUL3⤵PID:2624
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a4bea5df19396a42e5ab2dcb4fb7bba2
SHA144779aafb9768474085bac3db85e3c2a109d905c
SHA2565c17feb236681d4958edfeadae1f43da4a17ebc244ed1fb4dc2426e1479a6d7e
SHA512e33892556f4c0c21479e06eb77292126b4799cf114617364005b3972b15c39fbbacc8483685f10996bde6896fdaf95dc5a3013f3e1217dec03f47e006bb179ed
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize362KB
MD52bb32ba296e8b4e3e2c59bcb9e001949
SHA15c73145c052494e6477a5edf4d205e1c49f97766
SHA2561e27316673254a02e3fca2c4610da0edc76ebda59f0e2d2870a63c8c1fc4f266
SHA5124ecf8d7cc081efde510f957b65e2a9465ad3faeeab2ccb6ccd418c21a62238d70649132c4269aa7a551971d305f68aa075c7c5383c83e2a90c00c7782c2368fa
-
Filesize
10KB
MD51120232ded7af35414591790741db79f
SHA1dc013bad4101b14925b37860020a244bf603d014
SHA256158055cdf0cdd220c223701c44d789cd03ee34fd4b6adcb60c873b45fc5fe298
SHA512900942feb47d0522135aed2fd6cb8b03f35637e87c48f078a236f08e0e65d8043487a42af1ab9e6e607fc2c007ba8e609dd9ddc8f72f79b7f96cce4264c91132
-
Filesize
129B
MD5df7b1e2c99458dc0dce42ac7c12b74a4
SHA1ed49b55b078c9bfe058c7566b37aee078eba0799
SHA2561aa1a26ea82bfc9adc7fb7dfdf43aed4d374b86a8637a080f8e5eccdf7bb748a
SHA51286e6a17d59e0334b3c431fe82290cd01eab05aa9d69147a830b02e87a6dd437355941d31fd1059a3df3b9d2ac2551bbabf1368a1ed51cacc4f98d2802a978324
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf