Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
Resubmissions
15-10-2024 03:47
241015-ecgjlashrh 1005-08-2024 04:49
240805-ffygys1eke 1005-08-2024 03:50
240805-eee4jszepd 10Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 03:50
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
General
-
Target
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
-
Size
159KB
-
MD5
ef577a1a486aa3dba1b0acd46b54d3a6
-
SHA1
24897bc96bec3126c4a65c96b907fe57bd75359f
-
SHA256
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b
-
SHA512
9aae8575f067614dc9bb64c3d7ac604693500922780ae81a60d7cbcee91c3c12f9e20c7fdaf9a665a58e9c314cd4c185925719bc29ae2b702879d770a2a39e39
-
SSDEEP
3072:JuJ9OlKolUa1U197bzhVsmftsu3ieOfNqv1wxfs3Q0hU:Jufj0zi1dNVsmftSyyxU3Q0e
Malware Config
Extracted
C:\ooxlOmJxX.README.txt
lockbit
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion.ly
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion.ly
http://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onion.ly
http://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupa7e3b4pkn4mgkgojrl5iqgx24clbzc4xm7i6jeetsia3qd.onion
http://lockbitsupdwon76nzykzblcplixwts4n4zoecugz2bxabtapqvmzqqd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupo7vv5vcl3jxpsdviopwvasljqcstym6efhh6oze7c6xjad.onion
http://lockbitsupq3g62dni2f36snrdb4n5qzqvovbtkt5xffw3draxk6gwqd.onion
http://lockbitsupqfyacidr6upt6nhhyipujvaablubuevxj6xy3frthvr3yd.onion
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupxcjntihbmat4rrh7ktowips2qzywh6zer5r3xafhviyhqd.onion
https://gdpr.eu/what-is-gdpr/
https://gdpr-info.eu/
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation B47C.tmp -
Deletes itself 1 IoCs
pid Process 2300 B47C.tmp -
Executes dropped EXE 1 IoCs
pid Process 2300 B47C.tmp -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPk4mre0m73c4qouv93sg7yc6nb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPjeildkkvrs514n00fep9a8opd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPsc2m1ayy9mtt48sip7rqon6zd.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\ooxlOmJxX.bmp" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\ooxlOmJxX.bmp" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B47C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\WallpaperStyle = "10" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ooxlOmJxX 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ooxlOmJxX\ = "ooxlOmJxX" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ooxlOmJxX\DefaultIcon 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ooxlOmJxX 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ooxlOmJxX\DefaultIcon\ = "C:\\ProgramData\\ooxlOmJxX.ico" 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 1176 ONENOTE.EXE 1176 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp 2300 B47C.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeDebugPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: 36 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeImpersonatePrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeIncBasePriorityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeIncreaseQuotaPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: 33 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeManageVolumePrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeProfSingleProcessPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeRestorePrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSystemProfilePrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeTakeOwnershipPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeShutdownPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeDebugPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeBackupPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe Token: SeSecurityPrivilege 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE 1176 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1064 wrote to memory of 944 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 88 PID 1064 wrote to memory of 944 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 88 PID 1508 wrote to memory of 1176 1508 printfilterpipelinesvc.exe 91 PID 1508 wrote to memory of 1176 1508 printfilterpipelinesvc.exe 91 PID 1064 wrote to memory of 2300 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 92 PID 1064 wrote to memory of 2300 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 92 PID 1064 wrote to memory of 2300 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 92 PID 1064 wrote to memory of 2300 1064 1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe 92 PID 2300 wrote to memory of 60 2300 B47C.tmp 97 PID 2300 wrote to memory of 60 2300 B47C.tmp 97 PID 2300 wrote to memory of 60 2300 B47C.tmp 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe"C:\Users\Admin\AppData\Local\Temp\1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:944
-
-
C:\ProgramData\B47C.tmp"C:\ProgramData\B47C.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B47C.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:60
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3032
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{91D68F1D-2A2E-4357-AE69-40FF6B8FDF0C}.xps" 1336730348512700002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a5c80b89a574797610a95ec4f87c60c2
SHA138c83585f44351f07fafc8e85100246163977d52
SHA25600914ec2faf27923cfe381c6a2deb4335cadce6e33883e6e631439afd410e9ef
SHA5127b49495d532216124a25b9506964c842a20dd8e42c1ca011aa66a2c9ea9cb45fd23daf8570cb04e78cad2b251a7bc3eed3afce44015da8a6f701b757b136f582
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize159KB
MD5b6788cf2f247e50bf41090aa675d6b7b
SHA1c5c034cdc9865507237629db84b2415a40b761a9
SHA2568139fab25426ab3217cc6d5b2930c085d79bc5ee1dd075679fc120584efc3749
SHA512252e88e8217b028316205b0f7e6e54c84a1179af36295b4894e2b2d0f704f3eefbb8f1b5db5c278bc6c52a2d8da3ea63fc06e436ecbaee52315b284dd59174db
-
Filesize
4KB
MD55e81043e503f2c887dadf41a10e3632c
SHA19b6c36571db409b759a9c18e3f9afddca8c760f6
SHA256c31279b8ea18820edca4a033bbe7de78783214b127cc6d5dd5a06cf6da3f9fde
SHA51287a7a4b529ec8f24f722c8f2812c9b7d17742301938457bb889be9a974b0e603a2dce66f2709c318539820c56fac04eee90b22bda7ff563d497fdde3b5fb3009
-
Filesize
10KB
MD50df875455b7d8fede4649dc24d6ef9df
SHA1f48f99c5efaad87761408c8827dd7df88441a80a
SHA2561634f68f84be3c038f3bed4cd5fa3b0f1104801a3d7810c21361aca48ef0e9dd
SHA512a347d0f5d4daa72cb778d30819d8b4250ff7a3b070a3af7f4dc44760647a56236156cd97e7bc42059a145396b63b89ae2c25b61f6e4f221f9718542b77543c84
-
Filesize
129B
MD5ef71919aa7b8a1f95de39e2df893d618
SHA1f0e7b0b01c3647ce11a70b815a1d639129093ee7
SHA2567e2f4deb2aa83d43639c7fa85214f7e380c59f3c340438b72c910ca1a3854d4a
SHA512d414f8272e077d6b5f2342a5e9e26c5fcb80445becf258735cdfe50241f6fd151250e001a660ab742cdd688eb437cab1f3c9c5fcdd7d36e9ff6a414eacd294c2