Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 12:37
Static task
static1
Behavioral task
behavioral1
Sample
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe
Resource
win10v2004-20240426-en
General
-
Target
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe
-
Size
361KB
-
MD5
93ff3e682a69781cf12b88a1892066ae
-
SHA1
934a2fd88c884f7d6c544224594ef0e853efc1fe
-
SHA256
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f
-
SHA512
6e508d8442462e16cbc693c2b3794b2cf312fc65049d2e5f11f405222161ef013ff912ee7c71ac17cd9138dfe7210d587e12730f84c1eecfb17eb81d847599fe
-
SSDEEP
6144:hNM4IM8m9xa2DXkRh52DmuGAkUMRJcqUTiKb1UlfC884eRIEkxAgU+CZvz2jFtCH:5IMD9r7xDmFYMRmqsH1+q8De/kxAg3Cn
Malware Config
Extracted
C:\Users\1YwR2c1YK.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (147) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
21C3.tmppid Process 1092 21C3.tmp -
Executes dropped EXE 1 IoCs
Processes:
21C3.tmppid Process 1092 21C3.tmp -
Loads dropped DLL 1 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exepid Process 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1YwR2c1YK.bmp" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1YwR2c1YK.bmp" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe21C3.tmppid Process 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\WallpaperStyle = "10" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Modifies registry class 5 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK\DefaultIcon aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\1YwR2c1YK\DefaultIcon\ = "C:\\ProgramData\\1YwR2c1YK.ico" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1YwR2c1YK aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1YwR2c1YK\ = "1YwR2c1YK" aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exepid Process 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
21C3.tmppid Process 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp 1092 21C3.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeDebugPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: 36 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeImpersonatePrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeIncBasePriorityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeIncreaseQuotaPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: 33 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeManageVolumePrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeProfSingleProcessPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeRestorePrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSystemProfilePrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeTakeOwnershipPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeShutdownPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeDebugPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeBackupPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe Token: SeSecurityPrivilege 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe21C3.tmpdescription pid Process procid_target PID 2884 wrote to memory of 1092 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 2884 wrote to memory of 1092 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 2884 wrote to memory of 1092 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 2884 wrote to memory of 1092 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 2884 wrote to memory of 1092 2884 aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe 30 PID 1092 wrote to memory of 2036 1092 21C3.tmp 33 PID 1092 wrote to memory of 2036 1092 21C3.tmp 33 PID 1092 wrote to memory of 2036 1092 21C3.tmp 33 PID 1092 wrote to memory of 2036 1092 21C3.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe"C:\Users\Admin\AppData\Local\Temp\aa3c3863446db6a21f6f296a7c8671aa8e8df75e4899af39fde400182c4d0e5f.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\ProgramData\21C3.tmp"C:\ProgramData\21C3.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\21C3.tmp >> NUL3⤵PID:2036
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD521b0eeea7350ac2f7317f50ad4819648
SHA17796b896bbe6967c62ec5c8666c8eb8f693b2a2c
SHA256bb9ad2b1149e396c1fe3be2247807aed16bdc8ca3bba0e9bde3bc059ba1d2207
SHA5127ca94662c185fcf6470b09b1e96eeb06bd7cc02c20df3be8d8e7f0d612c83f975e9dfa3cdc1ea3424ea9882543b29f6ccec8b1c9fc715eda4c47800bc07d39ff
-
Filesize
10KB
MD56d25f2274d1101833372399efbc34b8d
SHA120de3a086624258fb1b383719a42479a50ca058b
SHA256225b6bed7ed8d4ba87a6692496174949bc7dc187b739b8807568f1c1215b6ef3
SHA512761832cebabc4a7bc576877d5018799c85fb2dfeb144a3632be1289452a5e183484ae9e1f2f3673117fb7a36a6a0bebb4b68db0a8aecb0d1d97c4884bed57bf0
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize361KB
MD5d320e4f585b7c0717b9a8ef3ee3253ae
SHA1c0df65c481b2080f6bb1b9659d34a29c269e0fc7
SHA256e853d837c9e474532de8f4c2bd366a5376c97cdc6653408fb0fd80adcc3aa388
SHA5126916e478bc21ad8560be8fac4a0da4c45ee70a6a98395e0c158d6d87459a7b12d7fc2f5949b0f3881c003b1686ac35ff37442720a1aad7b6b0be7026ff82a1a0
-
Filesize
129B
MD5f18fe773547a0a342d646f864991876a
SHA15ff477a5b87c89ccb7a1caf2d1fe6a648bc51ac6
SHA2568a166eca2c85e7bc3fe6662dffe91544d1646e5709481d86ec5cb17f802a389f
SHA512dc82a8ad63098ad905fa5267329435872a963054ab764cc417596f07a1863c137cf0b37afc636a343e2cadaa3e316b7b4d517ecb5e3f6d50c6ca01247a464b6d
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf