Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/08/2024, 08:45
Behavioral task
behavioral1
Sample
cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe
Resource
win11-20240802-en
windows11-21h2-x64
17 signatures
150 seconds
General
-
Target
cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe
-
Size
146KB
-
MD5
7aeb2d5c828d7c8c6525ce7710c81d7f
-
SHA1
d72bfaf7d9700beb02169c61373d1a11e3923138
-
SHA256
cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48
-
SHA512
2081495f5e3b7614baa88bd61028d77bfca3e8dc980ec16506027d42131ae2364db074ce7e5c4842d54741909775611dd4664ec70446f83b770bc7627785127b
-
SSDEEP
1536:ezICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDhhsfITrOOZUrDV17OK7jVUby/Y:FqJogYkcSNm9V7DiIdZc51r7jS1bT
Malware Config
Signatures
-
Renames multiple (612) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2136 DD9F.tmp -
Executes dropped EXE 1 IoCs
pid Process 2136 DD9F.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2842058299-443432012-2465494467-1000\desktop.ini cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2842058299-443432012-2465494467-1000\desktop.ini cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPc2grfo19unfk4pwqnp2gvfl3d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPrgim3h0x1vm1fh3osl_mpzz7c.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP01nw800jmu01s7f3lz0opphic.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2136 DD9F.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp 2136 DD9F.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeDebugPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: 36 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeImpersonatePrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeIncBasePriorityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeIncreaseQuotaPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: 33 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeManageVolumePrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeProfSingleProcessPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeRestorePrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSystemProfilePrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeTakeOwnershipPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeShutdownPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeDebugPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeBackupPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe Token: SeSecurityPrivilege 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE 3588 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4056 wrote to memory of 4408 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 84 PID 4056 wrote to memory of 4408 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 84 PID 428 wrote to memory of 3588 428 printfilterpipelinesvc.exe 87 PID 428 wrote to memory of 3588 428 printfilterpipelinesvc.exe 87 PID 4056 wrote to memory of 2136 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 88 PID 4056 wrote to memory of 2136 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 88 PID 4056 wrote to memory of 2136 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 88 PID 4056 wrote to memory of 2136 4056 cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe 88 PID 2136 wrote to memory of 2868 2136 DD9F.tmp 89 PID 2136 wrote to memory of 2868 2136 DD9F.tmp 89 PID 2136 wrote to memory of 2868 2136 DD9F.tmp 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe"C:\Users\Admin\AppData\Local\Temp\cd1837ab88989f53ec170c57f403d3712e4770494c2dac3a586e9d7503dcac48.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4408
-
-
C:\ProgramData\DD9F.tmp"C:\ProgramData\DD9F.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\DD9F.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2868
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3544
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D9FA9783-7819-493E-94A2-C004FED5053A}.xps" 1336783956280500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3588
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD511a3c2332a25feaa3ad9ec3d8b09ff67
SHA11b44f5fd4a9a7d806bbd8b17b31aa102714d060b
SHA256359e262586683a24241248c5c3e856d5cff22a4d7b3e7ae16da0aa164e65d478
SHA5127297d087bc16751c50aa06e435cab2a6a1ddb1880d8e17cd67ee726e31d5b18c2170c2c875f17b93c36b26765c66bf8b857816fdecb206799241f3ab1f403cf3
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\TTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTT
Filesize146KB
MD53c0a708dba57ca5ff0b617bbf55d983a
SHA1b76059cea79503be65c2857820440dde55c60622
SHA256103ca74c139ccb37fe122f06b0b7c8901f4cb112e71344b49d8c32a88685376d
SHA512c346b0bb1eba1a16598364134c817b2b191d9dc3b1017d90feb7a1563e73ddab2833176dfdfdefb8c215f6e9f3aa3421b0fa5eab00ac0af68578241ec29b74da
-
Filesize
4KB
MD5c28c7fa458feb07b402dae0f36e8da58
SHA1d3e1d44029964ed60834b7fdc32a18e9a1612c84
SHA256492acb4f37f3dc128d585ad7564196a4e87c9d5904b9f26cfe1c15baa8d00a4e
SHA512e5a95cc140bb6277403b35905620705dd4ebb2f8daaef588af9d7d3fbf3c833ebeee7244d91ac54e01ef78601bce87be93302b69855a72c3ac3066df07a67064
-
Filesize
596B
MD55427cd674e8f86faaa49f0e48a7d3fa5
SHA170f80c87a506eda9646345887e63fa11a054b03c
SHA256d671f9a2b73aab36554a437560291b23aa012b2d7527609123778900bcccd68f
SHA512b75fbbdc3769f2ac37a9d74755d4d1e5c47e7804319637e6fb7b0fb209c5b0aaf3a8c732fc4e6e7f69a92f34cca2b7980d3923b70a07ec3ee50cfe9813e4c65e
-
Filesize
129B
MD53e65e6897057e851128c2c69b779ebe9
SHA112e54c95299836e28594b996f72f235bf16630f4
SHA25602e0a245e17efcda5007c6fba7c38a7cc90e821cf880673b395c1a8de7fa1c18
SHA512e783fea2215e2b9d50fc8e8c47123790fb1e50fd4aac804d5d02ab61556389e7550510893fad47a4ba9b279affddb3e8e9e6793c5c8449f9e8de6bce60a90f14