Resubmissions
13-08-2024 12:55
240813-p5s37svarb 903-08-2024 05:56
240803-gng1lsvfnn 929-07-2024 17:59
240729-wkpzdawhlc 929-07-2024 13:14
240729-qg3heazdpj 9Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-07-2024 17:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe
Resource
win10-20240404-en
windows10-1703-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe
Resource
win10v2004-20240729-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral4
Sample
eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe
Resource
win11-20240709-en
windows11-21h2-x64
13 signatures
150 seconds
General
-
Target
eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe
-
Size
162KB
-
MD5
7e851829ee37bc0cf65a268d1d1baa7a
-
SHA1
672553c79db2a3859a8ea216804d4ff8d2ded538
-
SHA256
eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc
-
SHA512
856c6d27669b3123064d85adbc119414f5418f80bbbc9f85f4575df97cf34d1f4ab96fab5442a337ac6a90c076ba5af835f5286cb403acfb3a1e4fc5d0834ebd
-
SSDEEP
3072:rjvNTtA6pzarOLgSua/iw6kzg3qe1PTjrnFFMVUT6tSTC6D1vtPR1DO66ddJpW3h:r72qe1PTjrnf/KMR1j6df01fiuAP3xFm
Score
9/10
Malware Config
Signatures
-
Renames multiple (292) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\P: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\R: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\U: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\Y: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\Z: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\V: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\X: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\E: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\K: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\M: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\O: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\Q: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\S: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\F: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\G: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\H: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\J: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\L: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\T: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\A: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\I: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\N: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File opened (read-only) \??\W: eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File created C:\Windows\system32\spool\PRINTERS\00003.SPL eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe File created C:\Windows\system32\spool\PRINTERS\PP_8mugo9vrys5mowobpd_4cwtc.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3866437728-1832012455-4133739663-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\background-image.jpg" eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5136 ONENOTE.EXE 5136 ONENOTE.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe Token: SeTakeOwnershipPrivilege 3204 eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE 5136 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 6040 wrote to memory of 5136 6040 printfilterpipelinesvc.exe 88 PID 6040 wrote to memory of 5136 6040 printfilterpipelinesvc.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe"C:\Users\Admin\AppData\Local\Temp\eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5820
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{E7ADF9C0-1E87-40D2-8E1D-60F0B2AA9C1C}.xps" 1336674959225200002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5136
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
423B
MD57ff94943cdf15452a094e7a8587755b6
SHA1663d82d423fd075b4c87e6428e9c2556c474b88e
SHA2566497c4ac3c3c1dc3fa0405571007a21ae4cecb7cc7cc170c4ad17f683a6118a5
SHA512da91f22c6c9fd4f25a5bc6be74c2dbf1b4d886af97d6dba49de12bef6f9d511b7cd834bae1851a5b4057b665353b2d6b802c5c45076ca5af94827db2ef2028ef
-
Filesize
4KB
MD596ad1e86148c301b0b60caca030f33b6
SHA11d9e7ea2fe87481c7e095a5b2172ab1e99108148
SHA2569a4bc38df52d3d404c9427199c904deb1ee0a5f98232388fab77e9c8b901d132
SHA512e36bdab13828b0b0caa542e035476f01ce82c02f50b138a8cc3778b1e068978d3e6f0c4898ea1c341e165f2589d0cafd7e34321630e3b929f50cd22aabd5dc2c
-
Filesize
4KB
MD563c79db6b84aeae3e161f8ed9e6b9914
SHA1c22ed27bd492263e6d95a02818d052b66d83815b
SHA256a9a036593cebea2bf7f09466686e4549f5d8323cd0472002c1402d8f9ff3bb0e
SHA512bdf91740d54f561318854e07afb56af2b41c59f362cae7186c87b85c47a1ea213d54a1bf2c56dc1a7274f22734c33c74b0e684a16d92b38987f295df09b77621