Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 12:29
Static task
static1
Behavioral task
behavioral1
Sample
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe
Resource
win10v2004-20240508-en
General
-
Target
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe
-
Size
362KB
-
MD5
03bb39210a95173c9c6a474853878509
-
SHA1
8271693ac8f201a1e4d8db0069ed8346bd5a4867
-
SHA256
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d
-
SHA512
d0b21104ecb9ad6fe9a904d45e6586025aa04bcf5916ec6d9b2ed90e9b87a69091f9be6ea51d185fe1db9db7fda975e538ed44de351a4ab0969e3aa440e81714
-
SSDEEP
6144:lJDu8JE4WsGCv8jx/1s6L6Pk0eYq7rk5AsphFQWju5DZrnJirO5U8NUMHUz:l9u8JlLis6CeYqkxFQIu5D5nJirO5U+q
Malware Config
Extracted
C:\Users\o3LDjrpOa.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
Processes:
37C3.tmppid Process 1648 37C3.tmp -
Executes dropped EXE 1 IoCs
Processes:
37C3.tmppid Process 1648 37C3.tmp -
Loads dropped DLL 1 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exepid Process 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\o3LDjrpOa.bmp" d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\o3LDjrpOa.bmp" d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe37C3.tmppid Process 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\WallpaperStyle = "10" d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe -
Modifies registry class 5 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.o3LDjrpOa d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.o3LDjrpOa\ = "o3LDjrpOa" d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\o3LDjrpOa\DefaultIcon d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\o3LDjrpOa d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\o3LDjrpOa\DefaultIcon\ = "C:\\ProgramData\\o3LDjrpOa.ico" d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exepid Process 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
37C3.tmppid Process 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp 1648 37C3.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeDebugPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: 36 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeImpersonatePrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeIncBasePriorityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeIncreaseQuotaPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: 33 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeManageVolumePrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeProfSingleProcessPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeRestorePrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSystemProfilePrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeTakeOwnershipPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeShutdownPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeDebugPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeBackupPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe Token: SeSecurityPrivilege 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe37C3.tmpdescription pid Process procid_target PID 2212 wrote to memory of 1648 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 30 PID 2212 wrote to memory of 1648 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 30 PID 2212 wrote to memory of 1648 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 30 PID 2212 wrote to memory of 1648 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 30 PID 2212 wrote to memory of 1648 2212 d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe 30 PID 1648 wrote to memory of 1660 1648 37C3.tmp 35 PID 1648 wrote to memory of 1660 1648 37C3.tmp 35 PID 1648 wrote to memory of 1660 1648 37C3.tmp 35 PID 1648 wrote to memory of 1660 1648 37C3.tmp 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe"C:\Users\Admin\AppData\Local\Temp\d569da12fb9fa787609eb83d0ff07e1da2b2a336a681891375a7f0a3f654b41d.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\ProgramData\37C3.tmp"C:\ProgramData\37C3.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\37C3.tmp >> NUL3⤵PID:1660
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD505e1ca0b8222bb5ef1fc4c8bd29aed1b
SHA1b2c872a61677a873c49475c738bf9aff18066808
SHA256bba691d1217dd361bbfa2a23cf6fa49400a19bb7857b7cf5d149a3aea0c0d7ed
SHA5121590fc207a9e70d037993b4489e6ac0cc12056ee5b307dc4b0ab55e13da337c98406515255d53e2dc1922e8fcf59ebb3eb3dc9db5c5b7d3be28f1e47538eb313
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize362KB
MD57c979205fe34c6054c76d8e41c413590
SHA1324279ca11e19af7a4985daa9579d6b8060bc43c
SHA256febea4808d7a5a39ff584c576022d58b58a8dedcf99de9818ed0b29df399635c
SHA51232f4db2e937d25daa9c859c9c86d0fd6a3e444ec1c3854ec8d168e510fc1157193c3fe33c5d4849505557b9c44a75bf91cf0e6108b1c5af2198ea6b6f64a40d7
-
Filesize
10KB
MD5bf16fedbf12e7f782e552129bdfedc36
SHA1f0f0927a3418557a6779fb3f4f6f25208600e2ef
SHA256b6fd2d5b94e24ece49b05241829f69fd1684dd325288321d0656e65dcfbeca5a
SHA5122fc9f87e8f0b2b76eeec80ba8484c38f3e429cc3a4ea82d3e3301191ede965e62f16dd316d449df8aa665b59891d65d53fdedc13a28b66fb49988da7bc29d1b1
-
Filesize
129B
MD5517701143880d37365297b5d5f3824a4
SHA1aa77f881d5b862dffa11574a78cbd4f9d629882c
SHA2561c29e88d176743108f30a49c85f68974d8d2ed4f7149ba81fc4375ef93c248a2
SHA5124af840ab235c0c7aa0cee6d0384133d51409b86f24a59bd7f7053b965737dbf6fe3390bd3e932046d8e77215d2ed7c359712130918565641c9bb32b788b84cb4
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf