Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 01:11
Behavioral task
behavioral1
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win7-20240705-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
-
Size
146KB
-
MD5
6edfb62405f50d7fb16882ca9b16ed36
-
SHA1
73c346267e9527ca5886bf8a90b77f9ebceb58fe
-
SHA256
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
-
SHA512
b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
-
SSDEEP
3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
Malware Config
Signatures
-
Renames multiple (613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
B2C6.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation B2C6.tmp -
Deletes itself 1 IoCs
Processes:
B2C6.tmppid Process 756 B2C6.tmp -
Executes dropped EXE 1 IoCs
Processes:
B2C6.tmppid Process 756 B2C6.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
Processes:
splwow64.exeprintfilterpipelinesvc.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPp__1u60vti_rlx57eyrj5zr_b.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPpmzieoo00zh50gscguyjaxzfd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP0z9zr4r9hvtbpksx0vzszx9lb.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
B2C6.tmppid Process 756 B2C6.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exeB2C6.tmpcmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exepid Process 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
B2C6.tmppid Process 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp 756 B2C6.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 36 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeImpersonatePrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncBasePriorityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncreaseQuotaPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 33 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeManageVolumePrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeProfSingleProcessPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeRestorePrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSystemProfilePrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeTakeOwnershipPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeShutdownPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid Process 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exeprintfilterpipelinesvc.exeB2C6.tmpdescription pid Process procid_target PID 2912 wrote to memory of 1428 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 95 PID 2912 wrote to memory of 1428 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 95 PID 2912 wrote to memory of 756 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 100 PID 2912 wrote to memory of 756 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 100 PID 2912 wrote to memory of 756 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 100 PID 2912 wrote to memory of 756 2912 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 100 PID 368 wrote to memory of 1528 368 printfilterpipelinesvc.exe 101 PID 368 wrote to memory of 1528 368 printfilterpipelinesvc.exe 101 PID 756 wrote to memory of 1832 756 B2C6.tmp 102 PID 756 wrote to memory of 1832 756 B2C6.tmp 102 PID 756 wrote to memory of 1832 756 B2C6.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1428
-
-
C:\ProgramData\B2C6.tmp"C:\ProgramData\B2C6.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\B2C6.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1832
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2976
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{30AA221F-F589-400D-B8DA-71C8DF7ED327}.xps" 1336833069459600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1528
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD520d01d454efaf1ecba3972972fca7f4e
SHA18636664cb126751f23f5bffa543d29c402836995
SHA25683cfefec6961b1e7bd835624ab7a341625f11aa200ca1d257dbfea723a8b3b95
SHA512308c049583024b0de521edc8d23e230b236d8637b25ad6fd7dab88f8da26ae834106c3d04e4abc9796e83e789524cb63f08b83b2980b7af7591bf5f1668764b1
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
Filesize146KB
MD59ec743b4039aca6b6da865f1704df9a9
SHA1551885a84462fbeab707ff4aa81a1e37497e37f3
SHA256f3f626eb817c18adf861d2557730a65dbf525dc075261f633a9d3dcc380ef65b
SHA51276aeb5edc370e9b5950816f46bb0e8eb548d2fe8a45f96c9f79ddb8fc9ae04e5625dc87de15f7fc6f47e08b483070954a93eefc493621582cd5e230a4d8a5842
-
Filesize
4KB
MD5a82d70e33168aec3dafd1764494028d3
SHA1f04a193b0774c776a586ccc2da3fb803cbad0d6d
SHA2563b8fe00349731abd010030e5a15659d4b85b846973b7c8236185deb211ee4e2c
SHA512caa40c25d0ab383305e581ff0da06785a392ca30d5c001553e47c75bfde42d8aa7e5a2fe48004d46ea22448d2cb09f8b6970cd8d2f7147684b9fc8b638c518cb
-
Filesize
597B
MD58b868d53629149c6b3a461ff64ce8cef
SHA1b8a0b57cfe78c6d8468bdd5ef52411765a456e41
SHA2565f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25
SHA5122fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337
-
Filesize
129B
MD578777646aac067a66fadbb88a06f35cc
SHA1524976119a2087302651db8217a37c105210fd8c
SHA256fcec3d16558028bd93cdc44f14333f7bc7670bd78713a4fd3df8f5dca7733bc3
SHA512caf46dbbfa7a8583c1c518fe07045a5046ad39932d4f4bd2b8609065b0a87cae5820286f721ccc89a3808b8767a3e3262862eb44e2a44d977e631485d396d7d3