Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/08/2024, 04:32
Behavioral task
behavioral1
Sample
96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe
Resource
win10v2004-20240802-en
General
-
Target
96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe
-
Size
153KB
-
MD5
f0b8d4b35ba4a8f5fe791c484ce75987
-
SHA1
085b17ef9e1e65d98a0ff2e3555f9d31d12ec4e6
-
SHA256
96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68
-
SHA512
0e6fc2954b7df78faa894f3fa114f40f18b7ceb458723c6fb79d5b376dbd7e93fe38728ee57472093de94a65a19de50350f5194be07cf48c0eeb1ec884307cba
-
SSDEEP
3072:mqJogYkcSNm9V7DMrtcWrEi/CPOUjXBP57D2T:mq2kc4m9tDMrtcgCPO4r
Malware Config
Extracted
C:\dIwCjb7un.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Renames multiple (801) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 2324 6F66.tmp -
Executes dropped EXE 1 IoCs
pid Process 2324 6F66.tmp -
Loads dropped DLL 1 IoCs
pid Process 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2212144002-1172735686-1556890956-1000\desktop.ini 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\dIwCjb7un.bmp" 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\dIwCjb7un.bmp" 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2324 6F66.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Control Panel\Desktop\WallpaperStyle = "10" 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dIwCjb7un\ = "dIwCjb7un" 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIwCjb7un\DefaultIcon 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIwCjb7un 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIwCjb7un\DefaultIcon\ = "C:\\ProgramData\\dIwCjb7un.ico" 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dIwCjb7un 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp 2324 6F66.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeDebugPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: 36 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeImpersonatePrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeIncBasePriorityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeIncreaseQuotaPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: 33 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeManageVolumePrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeProfSingleProcessPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeRestorePrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSystemProfilePrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeTakeOwnershipPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeShutdownPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeDebugPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeBackupPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe Token: SeSecurityPrivilege 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2324 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 31 PID 2064 wrote to memory of 2324 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 31 PID 2064 wrote to memory of 2324 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 31 PID 2064 wrote to memory of 2324 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 31 PID 2064 wrote to memory of 2324 2064 96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe 31 PID 2324 wrote to memory of 1884 2324 6F66.tmp 32 PID 2324 wrote to memory of 1884 2324 6F66.tmp 32 PID 2324 wrote to memory of 1884 2324 6F66.tmp 32 PID 2324 wrote to memory of 1884 2324 6F66.tmp 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe"C:\Users\Admin\AppData\Local\Temp\96bb0750837c50f05f4b2c8c0ab52fa16e5c4c172bf42ace6d1ebaa891ef3a68.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\ProgramData\6F66.tmp"C:\ProgramData\6F66.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\6F66.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:1884
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1541⤵PID:2232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5088bc0375f5c301ebfa3da9079cc524a
SHA1b3a08c77a6c50202335ac1e1844311658f8b6bfa
SHA256f588267a7808f72f8a542d53f586c8e736aef585e839aebcf7769aebbb7cfafa
SHA512fa59ca520afa0e09a3c4ad40fdfaca5b370c5215492cf5376517fed756edf346bf044b742e639fa79d0312d1db8bb772b835a0d226f6a61c4a5c65357cf962a7
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize153KB
MD54fc2e6f794045a683317960834891ed4
SHA13524d0df752d87eae37836b0b337a1769b8c79f9
SHA256fbf0e089ebb2ee608352fb4407e18dfb173c1966f35222ffcc0c7d597c2f4f32
SHA51239a22c391db1546cab08a19d433cd873b87d3c4f708e82339c51171ab873e931a45510f0a0fc37a709fcfa46a6d7573e991b4719783c7ddef9d1e22d0019bfc6
-
Filesize
6KB
MD5dd746ace17e44ace00885b91400f11d5
SHA14a0302d2dca400598f396e4230fdae71779cbeaa
SHA256b27c3c8a30faf7c76483b7e5d964ae85046a9713caa46508ee7a1e31b7dc6272
SHA5128ac26aa7262fdf1afdc74e604720a79ebde076c75f460d7d5f57ff4d81dedb1ad471eb114ddd428c1934029746f5c222339090680bc77a6ea09ce329e1da3ef1
-
Filesize
129B
MD52238886db1c93d42798fbcb29fd85ded
SHA13c0ef7a05f9715eca475f92f39f509fc3d16af13
SHA2569d516fa540f288a2b427fd30d1528c31ff7a10f91db603352ce50082e56bb462
SHA512651f29ab504ab518dcb056b5eb4cb481b7605a504f9b406b55dc0ee6bf8f8241b7fcb9a40fb88f4a05e5120ce5491fa8da84014ccfac3ace1146afaf1e42049c
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf