Analysis
-
max time kernel
147s -
max time network
140s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-08-2024 05:32
Behavioral task
behavioral1
Sample
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe
Resource
win11-20240802-en
windows11-21h2-x64
20 signatures
150 seconds
General
-
Target
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe
-
Size
147KB
-
MD5
5820e728cfad98d8673d29448c58c7d5
-
SHA1
cfe71685fd09fd14d2d2faa8618b2559438a8b1e
-
SHA256
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7
-
SHA512
28ce7d774bd528a83e18fadf74e2826ae99031909e0907c83278604ba72a299942436721443ead9820a7e6bbc1f07c2e325886d316ed529fd12946c20e6cb9d4
-
SSDEEP
1536:0zICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDekDM2CpVTBVuVAPuzLsA/t83YY:bqJogYkcSNm9V7DekDMyVTzLVdwUOT
Score
10/10
Malware Config
Extracted
Path
C:\MNYHU2Jh1.README.txt
Ransom Note
~~~ LockBit 5.02 the world's fastest ransomware since 2024~~~
>>>> Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom
BTC amount 0.02
BTC amount 0 , deleted all files from you PC, and post all infirmation to public.
where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d
Time just 12 hr, after everythink will be removed
You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy.
After that, send a request with confirmation to e-mail , faster way!
[email protected]
or
[email protected]
If both email no answer, you need faster answer and unlock please use TOX
You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html.
Using Tox messenger, we will never know your real name, it means your privacy is guaranteed.
If you want to contact us, tox.
Tox ID LockBitSupp: 47C90F99E92AC0ECEAD8C2BD15B21866EBC1195B6E2B0412CE3658E21B696843FF4A8D144B24
URLs
https://coinatmradar.com
https://www.moonpay.com/buy
https://tox.chat/download.html
Signatures
-
Renames multiple (463) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
Processes:
AAD7.tmppid Process 4352 AAD7.tmp -
Executes dropped EXE 1 IoCs
Processes:
AAD7.tmppid Process 4352 AAD7.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3761892313-3378554128-2287991803-1000\desktop.ini 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3761892313-3378554128-2287991803-1000\desktop.ini 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPt102do4fef0qaqy_n19ekxnlc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPr1w60sacg3260gdse8aloquvb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPe4dh64bwyjc237uu60q0000qb.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\MNYHU2Jh1.bmp" 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\MNYHU2Jh1.bmp" 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
AAD7.tmppid Process 4352 AAD7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exeAAD7.tmpcmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Desktop 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Control Panel\Desktop\WallpaperStyle = "10" 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe -
Modifies registry class 5 IoCs
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.MNYHU2Jh1\ = "MNYHU2Jh1" 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNYHU2Jh1\DefaultIcon 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MNYHU2Jh1 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MNYHU2Jh1\DefaultIcon\ = "C:\\ProgramData\\MNYHU2Jh1.ico" 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.MNYHU2Jh1 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exepid Process 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
AAD7.tmppid Process 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp 4352 AAD7.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeDebugPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: 36 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeImpersonatePrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeIncBasePriorityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeIncreaseQuotaPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: 33 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeManageVolumePrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeProfSingleProcessPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeRestorePrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSystemProfilePrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeTakeOwnershipPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeShutdownPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeDebugPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeBackupPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe Token: SeSecurityPrivilege 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid Process 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE 4524 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exeprintfilterpipelinesvc.exeAAD7.tmpdescription pid Process procid_target PID 2340 wrote to memory of 5100 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 84 PID 2340 wrote to memory of 5100 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 84 PID 2156 wrote to memory of 4524 2156 printfilterpipelinesvc.exe 87 PID 2156 wrote to memory of 4524 2156 printfilterpipelinesvc.exe 87 PID 2340 wrote to memory of 4352 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 88 PID 2340 wrote to memory of 4352 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 88 PID 2340 wrote to memory of 4352 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 88 PID 2340 wrote to memory of 4352 2340 5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe 88 PID 4352 wrote to memory of 4740 4352 AAD7.tmp 89 PID 4352 wrote to memory of 4740 4352 AAD7.tmp 89 PID 4352 wrote to memory of 4740 4352 AAD7.tmp 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe"C:\Users\Admin\AppData\Local\Temp\5ccc9cb2e75c85b87f7244cca81c1acf6dfffe8f35a8c4d0ee00795872a9c9e7.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:5100
-
-
C:\ProgramData\AAD7.tmp"C:\ProgramData\AAD7.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AAD7.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4740
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3824
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{F5749037-1FBF-4E83-B21E-58C33CF939DE}.xps" 1336739597647300002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD580d0ea24bdfe6355cbf50faac860e308
SHA14332c388ee14fb4906d1b107f72362baf7810d68
SHA25651693968ce7e6770afbc6104207df030c15465c3c065ae73139da892851030ef
SHA5120ec8f3e5691d67dc5c2a447444714e1af42f98371b900506297755220e50e28058470970036b853942133881289b332c7750bcf3eb4b74fc13fc8bf0b4f5bd45
-
Filesize
1KB
MD570f8acf921f004784b21982bdfb5fb9b
SHA1a5fe82b54b1da9425c680e04ac9a0ea88ff4a225
SHA256497cdf0c2b83ff7b52d2b0e06985a0dd70746291f1c7fef1dd191e286a8f71f4
SHA51204c76d374ac49c6c6d72fd00c0bafe0bb50ab98f8e2e954f32c575720df623d1e1103954475e9a36a79de7820627ef5170d00ac1d768038e50ad1e4e80313084
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Filesize147KB
MD5304941d3190a261ca87002ccaf0cb11c
SHA12c6659d0a48460520623261a6286a253de0178ae
SHA256de9e4cff21fd05361faf6163adf13b13742f573033a6163f81340e881ad469bc
SHA512726f91dd170d6ee9a970f425ba04397517def5503fc584ad16838c920850344f47aadb4c6a48fc69b27d9f8794d30023466ee20f804eabbcdb7c0be7be5d319d
-
Filesize
4KB
MD58fd49fe2b7bbc7b6e1c35fb2ecc0f084
SHA14b7b681576a935405578b78992b6d08c76babd9a
SHA256f6094b5ab16835fc3e5e3c01da0583421fbb6cff9f93fbe47335cc666ca49f5a
SHA512cc1993b0f0c1c0c1e7ab6700d56c880be7f5705463fd0e537ac8608cd2f53763ecd1d11b2f27b28dbb3de03ed562df8d1c563194d457333aa82bcf08816dce2b
-
Filesize
4KB
MD5f8ec33ec0a7b80063554339f2e1de89a
SHA1cc91e78c81ffedd8b016dd005e78ca8fdcabb4ba
SHA256f5bffbf23043a35a505ae77ada5a157a12866e9ae4646b92be25ab6efcbc38ec
SHA51240b730639b55bbdbe0fc68640d89449ec9fd97abecf751a1bb4f45a5a16f5bfcdab71469c8cd1ef12cf7c2ef82d5762339b1b61a723789b8ec37c66af56c1448
-
Filesize
129B
MD51c58d2779c18c4d723b40736b98a5280
SHA140c75332efd30eff801569c036d9d3760de78b72
SHA256aac38f32da87c2f72ddbb1edab6b23d601ee32136dfb895adfd239b340395081
SHA512b1d5acaaa8c355255113a34762e5953954b70549b9cbdf586891a2dd4a1176e95516449a7296616e99c05cccbedb5a0daea04e5a4c597facadb29b317ea5eeee