Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/08/2024, 00:23
Behavioral task
behavioral1
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win11-20240802-en
windows11-21h2-x64
17 signatures
150 seconds
General
-
Target
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
-
Size
146KB
-
MD5
6edfb62405f50d7fb16882ca9b16ed36
-
SHA1
73c346267e9527ca5886bf8a90b77f9ebceb58fe
-
SHA256
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
-
SHA512
b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
-
SSDEEP
3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
Malware Config
Signatures
-
Renames multiple (544) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 3208 C6EB.tmp -
Executes dropped EXE 1 IoCs
pid Process 3208 C6EB.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2227988167-2813779459-4240799794-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2227988167-2813779459-4240799794-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPbh0olg_xa09z67wawf4kandxb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPz13pv5_rc622zy4ky3_rwdxg.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPzsb8bt00edultxzfz0ltxhefc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3208 C6EB.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp 3208 C6EB.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 36 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeImpersonatePrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncBasePriorityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncreaseQuotaPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 33 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeManageVolumePrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeProfSingleProcessPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeRestorePrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSystemProfilePrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeTakeOwnershipPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeShutdownPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE 3268 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 240 wrote to memory of 4460 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 84 PID 240 wrote to memory of 4460 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 84 PID 420 wrote to memory of 3268 420 printfilterpipelinesvc.exe 87 PID 420 wrote to memory of 3268 420 printfilterpipelinesvc.exe 87 PID 240 wrote to memory of 3208 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 88 PID 240 wrote to memory of 3208 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 88 PID 240 wrote to memory of 3208 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 88 PID 240 wrote to memory of 3208 240 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 88 PID 3208 wrote to memory of 2116 3208 C6EB.tmp 89 PID 3208 wrote to memory of 2116 3208 C6EB.tmp 89 PID 3208 wrote to memory of 2116 3208 C6EB.tmp 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4460
-
-
C:\ProgramData\C6EB.tmp"C:\ProgramData\C6EB.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C6EB.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2116
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5016
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{0EA21079-98E9-4CD6-A556-A1001D3F1428}.xps" 1336824143983000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5379633bed00e108463e208bcd449cf04
SHA1601ef4675c9baaf68820f18e3460158589aaee92
SHA25689535cb8fa8d3ee81af98973e68234bb456ff9ea2126cbc2fd1206ed9bd2e6dd
SHA512c0d6a166edb706e09c443b6a27a2fcedb0ad5238b2ce94ca321e86706fca48e24c29a95ccba39f7fc74989e0a82574afe93478be992175aee186895ee2e189bf
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize146KB
MD517e9eaeec6dab47c21bb6c92ef08515b
SHA10df84a54e57239de6fb87d38b02b14e4d8f339ca
SHA2565c6d9c4c480618019a9cb4a480fc2157a512e7459228092eaaa79de8f2f33c4a
SHA51270c1488ee59543763139724eb350bdf7b923b8159edc00abd67f534ab7fbe11fd92a9853180e5a7a7cdd988e59840b5965935cdf70b67bf5d7c1e74434a2f01c
-
Filesize
4KB
MD541f2aa688fc3d5062eb5dfa7b0e6e9a0
SHA1f711006d02e6ca0605fd13a2f6fb2f57bfca97c8
SHA256deff2b572357fd952a39cbf66e3190bf9b1ef711dd51f93167768e81ece1b4fa
SHA512763428185d41f980ce3ff8b85f2d7c6861bd170e1e10252211fae0368aa075f03df971ac4e5a0e300f26e264644b39cdf68fccc226454ba558fa008b2489bf51
-
Filesize
4KB
MD5a188c45320463880f5e9fcd7372e5f16
SHA1bd1415eaf2c19314a5f51c9f2db94625a72969a0
SHA256b952fb5e9b055c909094188bc525e9b8af08a9fd139ba7ed1257e225c4e75de9
SHA512b89f6a2a9a14e37a04ec3b692330542a8dad4bc94fd64fd0f05c4dcdf1ccb1e2312632c9607ab9db68520326f71e4cd4239f71ae8492eed25483c233bf79b31a
-
Filesize
597B
MD58b868d53629149c6b3a461ff64ce8cef
SHA1b8a0b57cfe78c6d8468bdd5ef52411765a456e41
SHA2565f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25
SHA5122fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337
-
Filesize
129B
MD5637a5ce2852286960b0b1498234acd20
SHA1093e0122e92dada579d0fae82a3fe198718ba12c
SHA25617550395b284a148903d1c84bbd7bc99fcf1317f6b2bed3cb5c6f1fc58ab5531
SHA512b396313828ea36e73a0c6078566fc341fd7d0161faf420867f861efa9385c3588e7473857ba70fdd9e4ac178d18c7f1f3851bb5c7f3cb204ac871ad0dbdcdefa