Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-08-2024 03:57
Behavioral task
behavioral1
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win7-20240705-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe
-
Size
146KB
-
MD5
6edfb62405f50d7fb16882ca9b16ed36
-
SHA1
73c346267e9527ca5886bf8a90b77f9ebceb58fe
-
SHA256
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
-
SHA512
b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
-
SSDEEP
3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
Malware Config
Signatures
-
Renames multiple (649) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 21F.tmp -
Deletes itself 1 IoCs
pid Process 4752 21F.tmp -
Executes dropped EXE 1 IoCs
pid Process 4752 21F.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2412658365-3084825385-3340777666-1000\desktop.ini 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP68znkoeekr8w9tv_lvp30z6hd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP0f_r2kkps60lx8qvcv15k4zgd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP87aaq68azpa3wl0t5ra6one4.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4752 21F.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp 4752 21F.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 36 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeImpersonatePrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncBasePriorityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeIncreaseQuotaPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: 33 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeManageVolumePrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeProfSingleProcessPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeRestorePrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSystemProfilePrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeTakeOwnershipPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeShutdownPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeDebugPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeBackupPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe Token: SeSecurityPrivilege 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE 4472 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4888 wrote to memory of 3156 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 94 PID 4888 wrote to memory of 3156 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 94 PID 3372 wrote to memory of 4472 3372 printfilterpipelinesvc.exe 102 PID 3372 wrote to memory of 4472 3372 printfilterpipelinesvc.exe 102 PID 4888 wrote to memory of 4752 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 103 PID 4888 wrote to memory of 4752 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 103 PID 4888 wrote to memory of 4752 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 103 PID 4888 wrote to memory of 4752 4888 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe 103 PID 4752 wrote to memory of 2696 4752 21F.tmp 104 PID 4752 wrote to memory of 2696 4752 21F.tmp 104 PID 4752 wrote to memory of 2696 4752 21F.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"C:\Users\Admin\AppData\Local\Temp\315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:3156
-
-
C:\ProgramData\21F.tmp"C:\ProgramData\21F.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\21F.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2696
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:5044
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{CC90B023-BBDA-4843-A4D5-6C88A155431D}.xps" 1336851344110900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5541ae979bdafb7633704e2cc0b5d6113
SHA1b62df544b8c7c360625bff75122914d83add7679
SHA25649f04c3f0e22f21989a6f361e60112720591b580e3edbd7684eb70b128629166
SHA51218f1db04aedb4d8bef2fcaae4069d50662e77162e1ec88ce33af227bcd61c4dd142ebc2616895e0426b336a4cd87f503c19b07e25cf2f2b12e129fae9336bbf3
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
Filesize146KB
MD5a2ebc9bded97fbaf2fa10a3862a95596
SHA1bcb67c9277188483fcf4ff4fdaa1b3761092243c
SHA2566e98cd36cb530c4e577486f10fc87994df74d1a911693c88703777cdc1ea52ea
SHA5126337a384958f5cdc43ac60ed52084e6d266f4b41b13decd6b25aad129526f725e15ef4a99647dc88362f930d9e1f301a44a52f2f93224e02db56a3faf167b86c
-
Filesize
4KB
MD567a2b8f80d0e49517dd0f55c0d6dcda4
SHA1c941e05e25c009fa3dbcf8dc9568902a28f89187
SHA2562dd98b6c7da59683973a5799bacee17d006aaffa45e5e34c244c344ef760abee
SHA5121e9b559424c5bbf5422f9664666faeb45c28384b66f594d23ff150d0b9adf4af8baf3f1b7839e7e3d4772e0a035077153334a399853add1a8d14a50541f70933
-
Filesize
4KB
MD57c862d00eff5cacb0e2e3d7cbf12b2c0
SHA1512535f8b2e81fd54421a320e8bbf074083ba7e9
SHA2563f257fe5b05af1940abf56de02305b9a0e960c80c700d1749d127cf34aa5af71
SHA512ae3bb8edc3f8555fc5cdb355eb4e6cb8b8b1ae64555d101c87f538ab997fb216db0df00485e26bcf93dbb6a0e3843263042b736f31a55f9bf93f54a7431f1b8a
-
Filesize
597B
MD58b868d53629149c6b3a461ff64ce8cef
SHA1b8a0b57cfe78c6d8468bdd5ef52411765a456e41
SHA2565f8d2cdb81cac5d0b7df3bae0634042b305b4ac7ad06c728b21df0ea9628da25
SHA5122fbb224b435621bc8947caf5aa4e294725f7df1c79dfaae1674086c8e92fcdb106d734680ac58e02b112613c778b582b2eaa8e6979dc1d75dc1dccab54f7c337
-
Filesize
129B
MD563e6b7bfb2f898aeae616bd72bdec4a5
SHA1797957e7a8be1117b33de01ce954944c1b761ecd
SHA256cdd13b1e081ec29f37b7285e5cb000712af8869e94b3e62ca40d333c3e47214b
SHA5129d4eb7c31facc1267dae871cb1a799bdb5ebd68adc3699bff280f196644b75bc6e8f3010d21aa0c13c64a8d59fb7506f8fb882b91ad67f79f2797e3b130e43e3