Overview
overview
10Static
static
100715240d1a...ce.exe
windows7-x64
907fec2205c...42.exe
windows7-x64
1010dc6e128c...c0.exe
windows7-x64
3133bf8be0c...de.exe
windows7-x64
10139a8bb2c5...c1.exe
windows7-x64
1019f7d53c4a...a0.exe
windows7-x64
102896b38ec3...9c.exe
windows7-x64
102d301697ff...f4.exe
windows7-x64
3337576503...d8.exe
windows7-x64
33e04fe9f42...f1.exe
windows7-x64
103e6fbc358e...45.exe
windows7-x64
103f7458e658...df.exe
windows7-x64
434ea9832e...27.exe
windows7-x64
1047792144c9...6f.exe
windows7-x64
105114aae6e8...8c.exe
windows7-x64
10537a2fd4d2...ba.exe
windows7-x64
355754358dd...1c.exe
windows7-x64
15b1caa9bec...c1.exe
windows7-x64
160c24a4c6b...21.exe
windows7-x64
963396a28b7...cc.exe
windows7-x64
978d4fce0c2...2e.exe
windows7-x64
37c27b9fef6...33.exe
windows7-x64
381689f1be9...ed.exe
windows7-x64
10995a91e668...55.exe
windows7-x64
109d90421b2e...56.exe
windows7-x64
10a597d34bc2...40.exe
windows7-x64
10a5e6df754a...d1.exe
windows7-x64
10add2850732...6b.exe
windows7-x64
10b098486c49...0d.exe
windows7-x64
10b923f1d2ec...ed.exe
windows7-x64
10bbdac308d2...4b.exe
windows7-x64
9c3fb821138...c1.exe
windows7-x64
9Analysis
-
max time kernel
1563s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
0715240d1af82c1cea262cde2a286b8b400805dc1f35f49422c7ee39e00f93ce.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
07fec2205cbbf2900ede2f6a1d9a5c428ef314c1dda559c632833a9c1d121542.exe
Resource
win7-20240705-en
Behavioral task
behavioral3
Sample
10dc6e128c7e5e7088f487ba9b22c1a836f50a552bc93fcce748d7e1c8f76fc0.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
133bf8be0cf7003b83b03579970997d408a930e58ec2726715140520900c06de.exe
Resource
win7-20240708-en
Behavioral task
behavioral5
Sample
139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0.exe
Resource
win7-20240704-en
Behavioral task
behavioral7
Sample
2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
2d301697ff72986171c0b2ccc979ab8e93671d640de6abad57de7d4e146b70f4.exe
Resource
win7-20240708-en
Behavioral task
behavioral9
Sample
3337576503c3e2d8876f50191ae8995b04a4536f816025c543d0e20250598fd8.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
3f7458e658401c15b675db78a2e9871ca3eeff3c6e299c4545515e56b66466df.exe
Resource
win7-20240704-en
Behavioral task
behavioral13
Sample
434ea9832e6d11d614905e3eb31c333289429095b76573f1ceb38fd10608bc27.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
47792144c9b440b3d2fbd422f68a23a8a8dfc16466d2a7430fc283a9d382826f.exe
Resource
win7-20240704-en
Behavioral task
behavioral15
Sample
5114aae6e86c7eedfbf181110e4fddfad88fe296ec590390705e00272121e48c.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
537a2fd4d214a212df06fb73b19ba945672eaf18d64cc30d8e99ab6a0d7cb9ba.exe
Resource
win7-20240705-en
Behavioral task
behavioral17
Sample
55754358ddd26b3c56ca27780dcc408711f8a9fc42b1c9d305d1045146f40f1c.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
5b1caa9bec8d7d7833b0e25f3e4256975c38a22c2901f8e4d99fb164dfde13c1.exe
Resource
win7-20240705-en
Behavioral task
behavioral19
Sample
60c24a4c6b54b1f4baeaee585e5e2486bbd3ab4733de36bb28da1fdb20596e21.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
63396a28b79a7eaa60c384bcb02699398cd3b2b0c14fe9cfaf52b2ffa57798cc.exe
Resource
win7-20240705-en
Behavioral task
behavioral21
Sample
78d4fce0c253356bf72cf72f260f27a3f0f3cf0a904a3618f3011cbe0b4e882e.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
7c27b9fef6e94e99092fb628716ae9114385d4d5753f72bff1221bad2eb54933.exe
Resource
win7-20240705-en
Behavioral task
behavioral23
Sample
81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
995a91e668b85a992c8a71aed191fa0fafa3b1606bf205bef93a2457786de555.exe
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
a597d34bc2464c3ace48ac04f6653f65ac4822ea8e4a5717ba9e4909b8c62240.exe
Resource
win7-20240705-en
Behavioral task
behavioral27
Sample
a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
add2850732c42683ee92ba555bbffb88bf5a4eee7c51e24f15a898f2d5aff66b.exe
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
b098486c49a73591ca003f20276f1ca33605618a7167407d9f3f096bc7ec930d.exe
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
b923f1d2ece074dabe58bb6a603ed5d49e8d62044a1293a37e8afbcac029dded.exe
Resource
win7-20240708-en
Behavioral task
behavioral31
Sample
bbdac308d2b15a4724de7919bf8e9ffa713dea60ae3a482417c44c60012a654b.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
c3fb821138d38ef9a2b0c77a4a3572ca38499b2dac3530c4a5faf2f789d57fc1.exe
Resource
win7-20240708-en
General
-
Target
a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe
-
Size
159KB
-
MD5
aa067ea48161558df3279ad6ad514088
-
SHA1
e4e8c9580c5eed71050105373612c5a298428262
-
SHA256
a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1
-
SHA512
abd076196fd64a1415f97080bcb9257c067c09b1909213ae698e32becfdbcb9c12ada134164f8a48ae06e14ded03a23d4e905369a49c12533e0dd9d7e4f74798
-
SSDEEP
3072:juJ9OlKolUa1U197bzhVsmftsryL7ujxTJNeorTE:jufj0zi1dNVsmftRel/lnE
Malware Config
Extracted
C:\Users\IcsBV4DBo.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Executes dropped EXE 1 IoCs
pid Process 1880 D8B3.tmp -
Loads dropped DLL 1 IoCs
pid Process 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3450744190-3404161390-554719085-1000\desktop.ini a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\IcsBV4DBo.bmp" a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\IcsBV4DBo.bmp" a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\Desktop\WallpaperStyle = "10" a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.IcsBV4DBo a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.IcsBV4DBo\ = "IcsBV4DBo" a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcsBV4DBo\DefaultIcon a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IcsBV4DBo a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IcsBV4DBo\DefaultIcon\ = "C:\\ProgramData\\IcsBV4DBo.ico" a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeDebugPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: 36 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeImpersonatePrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeIncBasePriorityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeIncreaseQuotaPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: 33 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeManageVolumePrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeProfSingleProcessPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeRestorePrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSystemProfilePrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeTakeOwnershipPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeShutdownPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeDebugPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeBackupPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe Token: SeSecurityPrivilege 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1880 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 33 PID 2404 wrote to memory of 1880 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 33 PID 2404 wrote to memory of 1880 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 33 PID 2404 wrote to memory of 1880 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 33 PID 2404 wrote to memory of 1880 2404 a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe"C:\Users\Admin\AppData\Local\Temp\a5e6df754a4d3bb72f4d5c91d6b582e7e2c2f87ca838f5d976bc82384a5ad2d1.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\ProgramData\D8B3.tmp"C:\ProgramData\D8B3.tmp"2⤵
- Executes dropped EXE
PID:1880 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D8B3.tmp >> NUL3⤵PID:1452
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5f6a0f314f6da7472bbdc616602a60794
SHA1c9e8f5b60c2e206ade4fdc257aaeccf24c213c68
SHA256465543f8904db34544996752f68cc765c9dcede54ecc3b8ca07c08e1c6da6d78
SHA512f671bc655d3e72db96bb37acfd09011b615ffacb57b6372c0ee73491966d7fb49ed57175648ccb177a53062855ac13b5feceb78fc7a6f24ce59f628154c1199b
-
Filesize
10KB
MD53a0696489680340dfb816d0bb1bb84f2
SHA11fd94bb7ac1b8dede0c83b5deb31da11b13a1e76
SHA256cc628b1f60b7d8a07c8ba455f8d7c618771ba99821edceb641dcc7ddfb20709a
SHA512e643a3d808dbde6ea37314c7d8af1c0d8ef70a98d1123db0a919b039271eb5b122f18fefabaeda543c262113d4a737f59f1df52c2047ba045b282f2941d63019
-
Filesize
129B
MD5348dfbdfacc5e56ad54021edf4f17a64
SHA15fd58dcb5d3dce5faef7cfabced5a0d1f421327b
SHA256fc9c40a369de30d11ca5a11be85da807dc0e8c2df868a2e637ccbbf674c0b205
SHA512265fd0f5dd4a6610cf1e0abeb140718feb83901d95da74490ff94eb3760cdf49ca4d16d475dad547f9c58d90c58577a995d95dba32d0a1add0e6c88e5cacc9b5
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf