Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301c647838c...7f.exe
windows7-x64
1002f5c32fa2...d6.exe
windows7-x64
61a05cba687...a3.exe
windows7-x64
101a8f35d0f2...b9.exe
windows7-x64
1af797776e...13.exe
windows7-x64
101b2b369f31...2e.exe
windows7-x64
31b4a0b685c...db.exe
windows7-x64
31b4d73a9a7...89.exe
windows7-x64
101ba8934b2e...4d.exe
windows7-x64
11c2a51daa5...5b.exe
windows7-x64
101c8bc3890f...45.exe
windows7-x64
61ce9fa5304...ef.exe
windows7-x64
1d51d46e07...cd.exe
windows7-x64
101db9ec5678...e0.exe
windows7-x64
101dbbed25cf...88.exe
windows7-x64
1de8054e71...a1.exe
windows7-x64
91e56efa724...ba.exe
windows7-x64
11e754e1c7e...44.exe
windows7-x64
31e8e39da21...bc.exe
windows7-x64
101e9e575dd3...86.exe
windows7-x64
31eb6de09f5...69.exe
windows7-x64
41f0daca3fc...d9.exe
windows7-x64
61f0efbc182...be.exe
windows7-x64
1fd42d07b4...6e.exe
windows7-x64
102a02608130...a1.exe
windows7-x64
12a05ac3c43...e4.exe
windows7-x64
102a32c84488...95.exe
windows7-x64
102a6c920bfb...dc.exe
windows7-x64
32aebddfd22...c8.exe
windows7-x64
32b245f773b...bb.exe
windows7-x64
102b331aa02a...b7.exe
windows7-x64
10Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 09:29
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240705-en
Behavioral task
behavioral3
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
Behavioral task
behavioral5
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240705-en
Behavioral task
behavioral9
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
Behavioral task
behavioral13
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240704-en
Behavioral task
behavioral15
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
1e56efa7243a1d6456e47a8736751a3e338c837a1f1e27da3ca804544df41fba.exe
Resource
win7-20240704-en
Behavioral task
behavioral19
Sample
1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
1e9e575dd30aa68e8cf8ff04cc591d429cdf1e09c3386e68d4cfb076dc997386.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
1eb6de09f5895458aefa5a1e603df84e403d54e00d5a07fa90a23dd850c7b069.exe
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
1f0daca3fc222298b58d0a81333fb6875fbe1b7ab77c98d2c37c3e026a27b7d9.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
1f0efbc1828ca978f4db5d847ccae5044c27c8efa266a71289f0d824035d44be.exe
Resource
win7-20240705-en
Behavioral task
behavioral25
Sample
1fd42d07b4be99e0e503c0ed5af2274312be1b03e01b54a6d89c0eef04257d6e.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
2a02608130d8a74a6f641132c071bed4cf0bf0838dc0f53fcdf807fc851818a1.exe
Resource
win7-20240704-en
Behavioral task
behavioral27
Sample
2a05ac3c433bcf896be4cf984b0ea5ea41006f2421cb4a4926d5eaaed6cf37e4.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
2a6c920bfb1259524d8e4e89c5408fd67c6fcfd2803b7a6c6dfbc9b86093a5dc.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
2aebddfd22ccb317b35b54e627d0eb05c59e761edbabe2a5029b19e8866e03c8.exe
Resource
win7-20240704-en
Behavioral task
behavioral31
Sample
2b245f773b616b41fc7eb3026a5216e1b792a32ef2e833800e2f3b300b3498bb.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
2b331aa02af211be4b0491a173e17e09993f5d0a1900271b97b41daae740aeb7.exe
Resource
win7-20240704-en
General
-
Target
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
-
Size
159KB
-
MD5
ef577a1a486aa3dba1b0acd46b54d3a6
-
SHA1
24897bc96bec3126c4a65c96b907fe57bd75359f
-
SHA256
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b
-
SHA512
9aae8575f067614dc9bb64c3d7ac604693500922780ae81a60d7cbcee91c3c12f9e20c7fdaf9a665a58e9c314cd4c185925719bc29ae2b702879d770a2a39e39
-
SSDEEP
3072:JuJ9OlKolUa1U197bzhVsmftsu3ieOfNqv1wxfs3Q0hU:Jufj0zi1dNVsmftSyyxU3Q0e
Malware Config
Extracted
C:\Users\ooxlOmJxX.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes itself 1 IoCs
pid Process 2732 CDBB.tmp -
Executes dropped EXE 1 IoCs
pid Process 2732 CDBB.tmp -
Loads dropped DLL 1 IoCs
pid Process 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ooxlOmJxX.bmp" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ooxlOmJxX.bmp" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\WallpaperStyle = "10" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ooxlOmJxX 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ooxlOmJxX\ = "ooxlOmJxX" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ooxlOmJxX\DefaultIcon 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ooxlOmJxX 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ooxlOmJxX\DefaultIcon\ = "C:\\ProgramData\\ooxlOmJxX.ico" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp 2732 CDBB.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeDebugPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: 36 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeImpersonatePrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeIncBasePriorityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeIncreaseQuotaPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: 33 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeManageVolumePrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeProfSingleProcessPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeRestorePrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSystemProfilePrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeTakeOwnershipPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeShutdownPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeDebugPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2732 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 32 PID 1716 wrote to memory of 2732 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 32 PID 1716 wrote to memory of 2732 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 32 PID 1716 wrote to memory of 2732 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 32 PID 1716 wrote to memory of 2732 1716 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 32 PID 2732 wrote to memory of 264 2732 CDBB.tmp 34 PID 2732 wrote to memory of 264 2732 CDBB.tmp 34 PID 2732 wrote to memory of 264 2732 CDBB.tmp 34 PID 2732 wrote to memory of 264 2732 CDBB.tmp 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe"C:\Users\Admin\AppData\Local\Temp\1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\ProgramData\CDBB.tmp"C:\ProgramData\CDBB.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\CDBB.tmp >> NUL3⤵PID:264
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5670d4a2206ce5a6168e5bc177b620fcb
SHA1bca43c9f7248929f18a1e34c12487259ea68f601
SHA2562a81b5a3081b787f57368c3adbf0c008c6a0b4744fa18ff55f43ed4ce44f2b28
SHA5120ba767c6eb105afdc5a3cd9870b67046063f124c7b7a925949f5c2af381ee5b5461f61f6d92305c77f7e41d322fb719b3f373fc27fa18e72a8bd1e9cc343e678
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD5a01c4b02e04ecfbbb58e82ce0bbd02e3
SHA1e5937899731611d7d41b24327c4b5b167ab0b07d
SHA2568b407ec6ae76aafb86dbfc768015029dfcec9f29e2acc7960fad67ef62472cb6
SHA5128c713f9719d7be670fbdd353edbb81967a846a8bc61e1858d4b19f9346dffc1c2c97a9f5557d0da2103befac7fc345c8b1af0664feb0f3e792ed2efdb5b56e31
-
Filesize
10KB
MD57814ebc3fdeb0a0bef16ddf418d527b0
SHA1266335b7d5cbcca81851588186be7b80599eca99
SHA256c917283bcd047c188b887ec5513113e88a7049286585729c6077d346bbb0c71c
SHA5120c100d108d5e2f429e4a80681676c9edfa439ff8ce4b4e70f64d4a45f5c88249b7ef77d7f1f5e15a0ece1d018c624050537fcbb93486ec2420c0bff7c4dace20
-
Filesize
129B
MD510bff268b81cbde41e02b0752b34bcaa
SHA11e10df519b35bc805faef68cbf143636121e1f32
SHA2563e297d8d3b7b4222643cf75dff91604f794a94478f3fed59966d173cf9f1b6ba
SHA5122d8d1cf3fbfa615c85cf646c4219f23f2e60aa08ea954888a4d2fd3cf6864d51d999adb1247f63e96b914353e026fd9e93c48e3c6137c85dd75c4b44b7f15055
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf