Analysis
-
max time kernel
59s -
max time network
42s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-07-2024 10:03
Behavioral task
behavioral1
Sample
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe
Resource
win11-20240709-en
windows11-21h2-x64
18 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe
-
Size
145KB
-
MD5
337559ae1b02b42586781787918b4b6c
-
SHA1
114577ce6270fde6ed9dbc782484bfa36766baed
-
SHA256
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505
-
SHA512
8f6a3ed66d74a3950c78b24c8617714697ba8f3eea8ff75ba74206a2ee814212389d50d2824cdf96311774f16730429e4bae28b9c59b97dd0baf4e20dc73189f
-
SSDEEP
3072:uqJogYkcSNm9V7D/Lwi7Z2ncxMN9vMWT:uq2kc4m9tDTwi7Z2cF
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
D300.tmppid Process 1224 D300.tmp -
Executes dropped EXE 1 IoCs
Processes:
D300.tmppid Process 1224 D300.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-514081398-208714212-3319599467-1000\desktop.ini c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-514081398-208714212-3319599467-1000\desktop.ini c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe -
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPn0flyqvjt3a7xiem4hnna3nbe.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPm66cc_wm2pbl043yc4pepcpoc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP_n27tmpskk42qvyv7sc8w42wc.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\txdM9F1WD.bmp" c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Set value (str) \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\txdM9F1WD.bmp" c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
D300.tmppid Process 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Set value (str) \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000\Control Panel\Desktop\WallpaperStyle = "10" c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe -
Modifies registry class 6 IoCs
Processes:
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exeOpenWith.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txdM9F1WD c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txdM9F1WD\ = "txdM9F1WD" c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txdM9F1WD\DefaultIcon c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txdM9F1WD c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txdM9F1WD\DefaultIcon\ = "C:\\ProgramData\\txdM9F1WD.ico" c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Key created \REGISTRY\USER\S-1-5-21-514081398-208714212-3319599467-1000_Classes\Local Settings OpenWith.exe -
Opens file in notepad (likely ransom note) 2 IoCs
Processes:
NOTEPAD.EXENOTEPAD.EXEpid Process 4496 NOTEPAD.EXE 1728 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
ONENOTE.EXEpid Process 2276 ONENOTE.EXE 2276 ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exepid Process 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
D300.tmppid Process 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp 1224 D300.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeDebugPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: 36 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeImpersonatePrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeIncBasePriorityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeIncreaseQuotaPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: 33 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeManageVolumePrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeProfSingleProcessPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeRestorePrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSystemProfilePrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeTakeOwnershipPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeShutdownPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeDebugPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeBackupPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe Token: SeSecurityPrivilege 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
ONENOTE.EXEOpenWith.exepid Process 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2276 ONENOTE.EXE 2464 OpenWith.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exeprintfilterpipelinesvc.exedescription pid Process procid_target PID 3140 wrote to memory of 2836 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 85 PID 3140 wrote to memory of 2836 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 85 PID 400 wrote to memory of 2276 400 printfilterpipelinesvc.exe 88 PID 400 wrote to memory of 2276 400 printfilterpipelinesvc.exe 88 PID 3140 wrote to memory of 1224 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 89 PID 3140 wrote to memory of 1224 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 89 PID 3140 wrote to memory of 1224 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 89 PID 3140 wrote to memory of 1224 3140 c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe"C:\Users\Admin\AppData\Local\Temp\c394e1673274a8d0861ed637c425de244ead5f8ffbc7cb84862d9b81ec884505.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2836
-
-
C:\ProgramData\D300.tmp"C:\ProgramData\D300.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
PID:1224
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txdM9F1WD.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:4496
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1492
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{90048E1F-303E-482B-B23C-94BE35A44F9C}.xps" 1336602985747900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2276
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2464
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\txdM9F1WD.README.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD57aec939612f68ba04aa24aa2bca6afe7
SHA12087b342edc5101df8006acf1e9c53c9813ed535
SHA2561ec3e42fa6437ae4f22156b1b1518326be85d95541d6b1575bfa77f0fbcef7a7
SHA512182923d5da9be5b1d607b0e5ca922453cd6745d204a1d98594ff860da847d2d8245bf59f85a71ee0ce55888a3db21086309c48da023ff68d76e430f9a85e7984
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
Filesize145KB
MD56b65f42042fb30261cfc56a60f7506b9
SHA1e8588fb875f0c87ef0e4db03e23a6184c87cfa4a
SHA256e0d5c3a8989221d1d8be4ffb16f1d76be222c1e0b7c07734a35f896bd91227cb
SHA512261253456af705256695ee966e30490d1383921738c62c865e40e6ad17ba32af5934f2a1dbc2200fc5c9ddda754d6d84e6273274776d2f4531d1dac823e55373
-
Filesize
4KB
MD5b775ac262189769cd6740d6952904baa
SHA13d576b63a69b4325d9e52c6d60b4a0863bd20059
SHA256b29d62acb145a7c06ba456dd21e88f52ccfb5cf2c3cacdb5ebea3837db06d8b5
SHA5120c44cdde75afd7373c0b80cdbf147678388969d3532eb5d1d6640be3f000310195c41500f1d62ed31184b4a7eb70452cc08df522c48f9f6a4e1298199f50b315
-
Filesize
27B
MD5734928ecdc131bc5f8de15316a4a3c36
SHA199f69f63b39bc26bab9e3a88a37e5eca67aff5c8
SHA2565778fea386e2432c9d30e0a22ad06a4021462d6688c3dd2bf19e7a0206049fd5
SHA512e0490bc9cb7cb18c99824eaf8aa37ee10be841245a3aa03f227d80dfd63ab125d025de6d9374883707a0ce60dc6e85079ada0bd1a22121ed9e9c75836fcf979d
-
Filesize
129B
MD52660d25b23c2e905f25a5ff88d2880cd
SHA106e8a90658fe1fe67426429e7fab0443f362581f
SHA256784f74439ed025d400c1029a78112121c9e8591270ba433c081f463538a84a79
SHA5122e1b096aa0ee49756570a80acbd2ec869269458d4d999c10072a116b5a4b7c9be23467fbe8a8b8b883ef610bc35c14cca00d913316b3c8ed39248a3d9721a554