Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 03:08
Behavioral task
behavioral1
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win7-20240708-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
-
Size
146KB
-
MD5
6edfb62405f50d7fb16882ca9b16ed36
-
SHA1
73c346267e9527ca5886bf8a90b77f9ebceb58fe
-
SHA256
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
-
SHA512
b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
-
SSDEEP
3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
Malware Config
Signatures
-
Renames multiple (651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation F628.tmp -
Deletes itself 1 IoCs
pid Process 4216 F628.tmp -
Executes dropped EXE 1 IoCs
pid Process 4216 F628.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP52wo6d13blu0y7io_nnar8eod.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPk_3uk8o8l4tvvy9p9lwwa9fnb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPpktpxmr035cuyiv59dzg67l6c.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4216 F628.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F628.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp 4216 F628.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 36 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeImpersonatePrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncBasePriorityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncreaseQuotaPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 33 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeManageVolumePrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeProfSingleProcessPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeRestorePrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSystemProfilePrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeTakeOwnershipPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeShutdownPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE 3840 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4464 wrote to memory of 4648 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 95 PID 4464 wrote to memory of 4648 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 95 PID 4464 wrote to memory of 4216 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 101 PID 4464 wrote to memory of 4216 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 101 PID 4464 wrote to memory of 4216 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 101 PID 4464 wrote to memory of 4216 4464 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 101 PID 1972 wrote to memory of 3840 1972 printfilterpipelinesvc.exe 102 PID 1972 wrote to memory of 3840 1972 printfilterpipelinesvc.exe 102 PID 4216 wrote to memory of 4668 4216 F628.tmp 103 PID 4216 wrote to memory of 4668 4216 F628.tmp 103 PID 4216 wrote to memory of 4668 4216 F628.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4648
-
-
C:\ProgramData\F628.tmp"C:\ProgramData\F628.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F628.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4668
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:516
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3311EBCD-77E3-4189-81D2-9237ADF903AB}.xps" 1336842412131600002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD54f826818838e23e6c7f0815aef577ae5
SHA11b753f3de0d0e036cd2eb42f3d3fe35c0ce54c4c
SHA2565ef7f97e22abbbd81493eb32a462f025ffb5dce83a00069684a720b67a00743e
SHA5127f6e6b00663196f5a2e2f0947424f5ac128ef3b53b1a7c3a4d0d9baefa4058198a05cc9524875d0edb93906b972e48bdffe2a4a53bd9fc64376d2be94df0634e
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize146KB
MD505b2c07fb0151b5d2dfa00c9beb8a81c
SHA10956eb939651e32ffbf51ed60eeb175387c01aa5
SHA256dc55d3395eaebd7b0a823639ee2d282bb8848f81aef40422b4bfb90e09413b71
SHA5126a13e1d251ff562c9c0b39dd9551e3745413bf445b868bb881dda38f2b01dc2aa404ad2c6061138434646e2b0c8d471c6d02d0b423cc7a39700d2e9404cb164d
-
Filesize
4KB
MD59b19485dcf3cbf43dc4c611e00962d52
SHA113ced96c9a746f19c98e608a657c618e0a3dc676
SHA2563a4fffc51e1a2cf1a2a5d61f593d20d634360a7c3d51df2d6a93fa551fe95694
SHA51280d3bf3d6cee55060bf913a86e83c1bb634d07c6bd9b4b9d41637a1609496f47bc9379ee95907778d697125cdc518ab82877ae051936c24cf98fc835505b407d
-
Filesize
597B
MD58b868d53629149c6b3a461ff64ce8cef
SHA1b8a0b57cfe78c6d8468bdd5ef52411765a456e41
SHA2565f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25
SHA5122fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337
-
Filesize
129B
MD5376a5b9c8f55d7327c583429cfb1292c
SHA12fae19f69b0a6a2c43c31c0e419907b64510d3cd
SHA25690f6599a35a2a269c52c63b82cc1d68d59fa753587a04bf4c58729d8c40ffb35
SHA512d955c642acbc58c6186672ccf2730b1347b07edbac8f0b45e8c55614a583ba605aca37e99b83d5dfe0c8da5718de849bf6f67e8eccefb7b565478d13bcb4ddaa