Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 10:29
Static task
static1
Behavioral task
behavioral1
Sample
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe
Resource
win10v2004-20240508-en
General
-
Target
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe
-
Size
361KB
-
MD5
93ff3e682a69781cf12b88a1892066ae
-
SHA1
934a2fd88c884f7d6c544224594ef0e853efc1fe
-
SHA256
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f
-
SHA512
6e508d8442462e16cbc693c2b3794b2cf312fc65049d2e5f11f405222161ef013ff912ee7c71ac17cd9138dfe7210d587e12730f84c1eecfb17eb81d847599fe
-
SSDEEP
6144:hNM4IM8m9xa2DXkRh52DmuGAkUMRJcqUTiKb1UlfC884eRIEkxAgU+CZvz2jFtCH:5IMD9r7xDmFYMRmqsH1+q8De/kxAg3Cn
Malware Config
Extracted
C:\1YwR2c1YK.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
3D2F.tmppid Process 2096 3D2F.tmp -
Executes dropped EXE 1 IoCs
Processes:
3D2F.tmppid Process 2096 3D2F.tmp -
Loads dropped DLL 1 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exepid Process 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1YwR2c1YK.bmp" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1YwR2c1YK.bmp" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe3D2F.tmppid Process 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\WallpaperStyle = "10" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Modifies registry class 5 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1YwR2c1YK\ = "1YwR2c1YK" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK\DefaultIcon aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK\DefaultIcon\ = "C:\\ProgramData\\1YwR2c1YK.ico" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1YwR2c1YK aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exepid Process 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
3D2F.tmppid Process 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp 2096 3D2F.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeDebugPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: 36 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeImpersonatePrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeIncBasePriorityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeIncreaseQuotaPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: 33 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeManageVolumePrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeProfSingleProcessPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeRestorePrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSystemProfilePrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeTakeOwnershipPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeShutdownPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeDebugPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe3D2F.tmpdescription pid Process procid_target PID 1992 wrote to memory of 2096 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 1992 wrote to memory of 2096 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 1992 wrote to memory of 2096 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 1992 wrote to memory of 2096 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 1992 wrote to memory of 2096 1992 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 2096 wrote to memory of 1188 2096 3D2F.tmp 35 PID 2096 wrote to memory of 1188 2096 3D2F.tmp 35 PID 2096 wrote to memory of 1188 2096 3D2F.tmp 35 PID 2096 wrote to memory of 1188 2096 3D2F.tmp 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe"C:\Users\Admin\AppData\Local\Temp\aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\ProgramData\3D2F.tmp"C:\ProgramData\3D2F.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3D2F.tmp >> NUL3⤵PID:1188
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD513f0c2cc4099b8554765f161a323b749
SHA176776d01dbab17289e9d55676db090744a03a1c2
SHA2563bdc51842171caff1cb28f0a8affdbc256b4182f1f5e1ec3d6b68a5d64b05e0e
SHA51224cf595e0384bb969405b24cb84185998468821a71e0654bcf6076681e90b70d6fb8f07d94e98bddf97f5e2c93b6e9872758d94a33e1a2a1daa5ed8b2dfe85bb
-
Filesize
10KB
MD537017ff8a0fdb8611f28cb87ff9a987c
SHA10645dd441f538f76c8d037ff47bb064859547c62
SHA2562f248876e18bb42c517059869faed84b892128608d4f829a9615eb54c34b315d
SHA512f4ac853bfbb8fe60a665ebf8be2705123e46e1ca41b2467a9d3e7a2c9c23a49a80d62050c1faa200ef7031cdbf1801a0292fe1222f2f62bc54ca51e9be345b15
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize361KB
MD54f490a7743eb5535412d252e5cc785b5
SHA117beebd4c1a834c75cc177e4837c4c5f6726d5a5
SHA256bd20c8147e1598fef5f353e2a193436291a05c908ec4d5010bc593b09a859a37
SHA5127ecc47b5422df37d9345a189820921946763c4ede3f7d388cc7c5c62218ed442e72fbcfe1f7204f6568541ae7236cfcaabbb95ca26f893976dc55f447d12fe03
-
Filesize
129B
MD58c2ddbf23d92c3f181a495d65b0fc533
SHA130d6f372dbeb67d91e9520946b49671f6d5b71cb
SHA256d396b74790a9ef04bd52416eebaefe236f4a61eb7724295da1b09088d1156118
SHA512ae2738a4f3f7b98cefe6229be6b4fd097b560309eae93f0f9f0f8cb23e8a7bea6318d98fc99b311ef1bd408b6f4b750cef529872f530de779f60cac071e99fc0