locky | e6a7cd09db490104366798d6ea71a3f1f8df01d59394e36ef6e1a8ecb8facf1d

Analysis

max time kernel
268s
max time network
268s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-09-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hel.txt
Size

455B
MD5

f31e3269ee1cb4c18a1eea1166e8938a
SHA1

ec636628ee8b40c7df406a32ce1821361045594f
SHA256

e6a7cd09db490104366798d6ea71a3f1f8df01d59394e36ef6e1a8ecb8facf1d
SHA512

3ff8dfd9b8be1e5a13579169cbd197f57de8475492caac330b893200b8f5ac2c799e8abb0d35d1807e3999ab7d363dfbff5082d78f04d5bfdb8ad04fb9405248

Score

10^/10

locky defense_evasion discovery ransomware

Malware Config

Signatures

Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
ransomware locky

Executes dropped EXE 1 IoCs

pid	Process
3452	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
3336	Locky.exe
3336	Locky.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	minesweeper.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\Minesweeper\desktop.ini	minesweeper.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
66	raw.githubusercontent.com
67	raw.githubusercontent.com
68	raw.githubusercontent.com
49	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Locky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Locky.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft	minesweeper.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	minesweeper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}\LastPlayed = "0"	minesweeper.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Ransomware.Locky.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Ransomware.Locky(1).zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2248	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3544	minesweeper.exe
3980	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	firefox.exe
Token: SeDebugPrivilege	1624	firefox.exe
Token: SeDebugPrivilege	1624	firefox.exe
Token: SeDebugPrivilege	1624	firefox.exe
Token: SeDebugPrivilege	3980	taskmgr.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
3544	minesweeper.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
1624	firefox.exe
1624	firefox.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
3980	taskmgr.exe
1624	firefox.exe
1624	firefox.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe
1624	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1928 wrote to memory of 1624	1928	firefox.exe	36
PID 1624 wrote to memory of 1704	1624	firefox.exe	37
PID 1624 wrote to memory of 1704	1624	firefox.exe	37
PID 1624 wrote to memory of 1704	1624	firefox.exe	37
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 1684	1624	firefox.exe	38
PID 1624 wrote to memory of 356	1624	firefox.exe	39
PID 1624 wrote to memory of 356	1624	firefox.exe	39
PID 1624 wrote to memory of 356	1624	firefox.exe	39
PID 1624 wrote to memory of 356	1624	firefox.exe	39
PID 1624 wrote to memory of 356	1624	firefox.exe	39

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\hel.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2248

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2524

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.0.648143398\1508113389" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3278d6a-39b0-4006-9f29-d13532b3bf6a} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 1332 109d3558 gpu
    3⤵
    PID:1704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.1.590307478\153348909" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c331501-f86a-4f8a-a43a-c7db60be25af} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 1500 f5eb258 socket
    3⤵
    PID:1684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.2.1389200257\363386123" -childID 1 -isForBrowser -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60b66f0f-81ed-46d3-ac3a-4b4a4a5d06e9} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 2072 1a887858 tab
    3⤵
    PID:356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.3.199628491\81584474" -childID 2 -isForBrowser -prefsHandle 2412 -prefMapHandle 2352 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {991c65af-ecce-4b90-b37e-e20199e31f63} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 1720 e67758 tab
    3⤵
    PID:876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.4.375685105\360977746" -childID 3 -isForBrowser -prefsHandle 2964 -prefMapHandle 2960 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1415e85b-0a89-49b5-89b3-bfe6bded88c8} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 2976 1c3b5d58 tab
    3⤵
    PID:1500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.5.167930331\1571556769" -childID 4 -isForBrowser -prefsHandle 3788 -prefMapHandle 3784 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c06fbbcd-94c3-4250-9294-5e025134c386} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 3804 1eaef058 tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.6.1552577169\1938780835" -childID 5 -isForBrowser -prefsHandle 3912 -prefMapHandle 3916 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc8cc848-f7fa-42bd-9803-7b87888b052d} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 3900 1eaeff58 tab
    3⤵
    PID:2828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.7.2109361744\1663574193" -childID 6 -isForBrowser -prefsHandle 4172 -prefMapHandle 4180 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {692ce162-ca62-4bfa-a360-82f6d6aa4a07} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 4160 1f8d7c58 tab
    3⤵
    PID:2816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1624.8.1909232686\910140592" -childID 7 -isForBrowser -prefsHandle 4544 -prefMapHandle 4540 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 740 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {533ca8d5-51b6-461f-bf33-c818c1d59857} 1624 "\\.\pipe\gecko-crash-server-pipe.1624" 4524 20c21e58 tab
    3⤵
    PID:2112

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Locky.zip\Locky
1⤵
- Modifies registry class
PID:2296

C:\Users\Admin\Desktop\Locky.exe
"C:\Users\Admin\Desktop\Locky.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3336
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3452
- C:\Windows\system32\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sysD1D0.tmp"
  2⤵
  PID:3484

C:\Users\Admin\Desktop\Locky.exe
"C:\Users\Admin\Desktop\Locky.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3364

C:\Program Files\Microsoft Games\minesweeper\minesweeper.exe
"C:\Program Files\Microsoft Games\minesweeper\minesweeper.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3544

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft Games\Minesweeper\MinesweeperSettings.xml

Filesize
11KB

MD5
ff8c2bdb944f54e9addc85bca23e71c3

SHA1
449480b29dee0aa6af61e1c7504444db34162e19

SHA256
46ae735be66efa8106d382cd571034d519c14717159b7f4085c1682c5fc7528b

SHA512
e0cbd8182892abd4e8d05c3fb998b376f7767af8aad1a54602aecc71fa834f7929539f0f42f1ffbcb4db575f849a12514e2685ac8de8be41c1f44f06d39f6d95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\GameStatistics\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}.gamestats

Filesize
3KB

MD5
11b1cb66abbbe81e007ddd2959f6b068

SHA1
f87a67ffe354b00cbb2f492701b6429762e9c87f

SHA256
cb5314886a9d885e9d9df33497476223bd30ead81d8cd8ddb7a977bf15675184

SHA512
efcba4aaddaea5e60c120811bf8e04664fea877b4fdf3559aac086a68ad679a8561d43b53a76ee6bef5d5ca8b4bd452a22082ed8a68a78ead7bde02b106230bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\GameStatistics\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}.gamestats

Filesize
3KB

MD5
d989d55ba606463e6a539ca0bd91fc08

SHA1
156197fb5df94b8afe08b53de09a5854cc687e81

SHA256
4b81636432d2b454bfd66d6032eb090f6c0b58c109049731b57c4f3d1e06bfc0

SHA512
ffa45e9c843c490155cc6e531e2373f5ee757737390044607ad9f7dbd3593b4f7c3f1ee41b0147dfacd17618789eb017996df0615a3f7160ba1e1bc6ec990517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\GameExplorer\GameStatistics\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}\{89FE5CB3-11CB-489C-AC0D-0C0B6707E1F6}.gamestats

Filesize
3KB

MD5
40cf868237f73f6333b7e82f32da7a01

SHA1
d566e7048cb82c72736f4c7c8679c2e2f6a082aa

SHA256
d51d7e27a660e9606cc6d0c7c52bd98744178cff36791ffca6ccaa614071aa57

SHA512
63aae1ef90a485789ee96ff6f89447afb8e605ddf281c35c8cbf63081c9785136d36b6df0958c869c9f267008f2f7a0a0d1bf18cfdefe2e0b4e643be309dc009

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\activity-stream.discovery_stream.json.tmp

Filesize
38KB

MD5
eb62cae08adf17388d0800ba602767ca

SHA1
32d395a3e4ecc19b3c195c72b7c9c2bfc8b8e8d2

SHA256
8ec7a09e838819cac83b195f1c372c1ee0aeb8ce39b655aed885af7b74c55958

SHA512
0baba9054fdc64f137fe8c2e613914577218a9d69cf5e4fb0c979a4ea58448f54368c0b8a20af98398331a1dea209a23798a4995aaea57f1d70885f321d608e6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\27890

Filesize
13KB

MD5
8de67feb69ecd457997ae246a63e4614

SHA1
edf39ecfa3b0507fce90d8215cb71f896c7e6d92

SHA256
2b1c61a0d7caf1d7bb15b7cba87bf9260498d88dfb9eb4f716393494dea488d9

SHA512
f11d676db84853cb971434f48b286edbcd497c7cee9f02c0a4880aa2d23f63c5ec353f031d0b8dbb8d3d9979f1d8ee05e83907c8943e1457d523b6e1efd0d7c3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\29574

Filesize
13KB

MD5
ebb7a75963e9ef72bf23ecc1fe7b6b8b

SHA1
f588cb2ed9c9581950673ab0c8715f2e7c911c0f

SHA256
e7d952d34e3d7dbc96d9f06085774ed4cddd477fd877581b5cbdd21862b149d1

SHA512
ce62390fce540cd4fe38a791eedde528b62fb254303748893b8c2bd8d03c0f2cb0fbf36e1b78615663784845baed72857a684e3b40fa01f7c83aed543e09c46f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\doomed\9673

Filesize
13KB

MD5
4d474dd582e26cd94fff21d52c1952c9

SHA1
9578bba8caaf39c267b4bf136fd0f9e9fc55829e

SHA256
870c01c96933ebc83ee8fb1501a6d69469bc882f3d85a3d0d32fab5913bc53e6

SHA512
5c91503eb49654c2bb7afda8053acaf75ae9aa5beea8c9e2ee1bc6eca556b22b017184c80c4a47ce3a7c227ec6fb121a409a27d1d710a395a60ee0ec7f88797a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\6CEE2727CF2F7831FFE7912B9B073F4BA25A9DE5

Filesize
66KB

MD5
67147d169a4b4d9c56917b5f5919de5c

SHA1
7bdc86179c94ee909e15b3268a573f6a968150cc

SHA256
3e9049e2e7190e710adb1ad913351ddf606edea5d226ecd81f92cdc2683bda1b

SHA512
c044207aceffb85cfa47d195ef43fc9e638fdb2f464d6a0cdea8052c992e69622adff503eb537655cf0a35a81f925c779af58f81c59d137f08f95188c522d218

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\BF379DF1D1F03D48CD42953E75E8B8E61CEA1631

Filesize
66KB

MD5
db81b17d19c7da53eac1d85efbeb759b

SHA1
783b999b7a2ae51cf46a49d1420376f07b6d4769

SHA256
2f488ee4b9ab0c541ddddb35c35fcf5311be9b8a0451bfda11567fca3dfe79ef

SHA512
9dcb52766506ef76bdad905611f7fe5c6ef1bfddc008a159ff41649b5936b291d74da1f31145ca745bd976a8d8119fdfe81c434d8c27fccf2a3c4abb5186854a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E6C22A3DFCD18E3C6145370266896FF76AE3F7EC

Filesize
39KB

MD5
005ce0c4461315876cbef366c800c2eb

SHA1
e5499152570b901d9a898d4872a3d9521e9e603b

SHA256
f56ad42b956df8d51ed9586ab985da5340c543de5611da31abfd3c145423b2a0

SHA512
3bca84f58ec1b3e2069c338387ce258df6f43694461d36b5fc1dc9ae28b0c6a118b898b8a507fb362f2f7f4d5b698b03ec0cf7b9863e9d57144c268b68bf56ce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\cache2\entries\E9E757A35FA9EC6E5EA3D833361C03F6B515EC53

Filesize
68KB

MD5
060a1ce68b20fa5199f96d1e7dd11e99

SHA1
5e59798bf9b9d76950d34fcdfd487b65b2d38efa

SHA256
78bd86b9e2a7e0a9f9acb7cc1ddd82435b39f2280c1bbf296b2111847577a981

SHA512
df33772436685f1600cd3ece69cffae26d50b6908abeae5ed8f30ec7a929dc54960c663d75801f6140750c858f8b959e8ed5c47cbefe4e45159053e0e6487177

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
180KB

MD5
b06d9dd17c69ed2ae75d9e40b2631b42

SHA1
b606aaa402bfe4a15ef80165e964d384f25564e4

SHA256
bc98c8b22461a2c2631b2feec399208fdc4ecd1cd2229066c2f385caa958daa3

SHA512
8e54aca4feb51611142c1f2bf303200113604013c2603eea22d72d00297cb1cb40a2ef11f5129989cd14f90e495db79bffd15bd6282ff564c4af7975b1610c1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
49e1d5b428ec36d9fe875fb740555254

SHA1
2626e560232e7b63366b6e6f72bd76b50ffbf60a

SHA256
e899eb9035e99483b2a973a63d1f47c4fa2488aa65e47c4f7ae4b5ca3c7275bd

SHA512
c5dade67a90ff0cd710862339c2d5a167fd76e05eb8b4805d29e7d2afce032ac3363ddf6b97d20da349c95f404f895060a8b48850ad1bcdd3c346d07b215077d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\30b751d8-271e-4ab8-b891-1cb9259c4575

Filesize
745B

MD5
e179940e88644036ddb8f0e27aee4938

SHA1
77260fd637636cae8de27282017f52cae1e1a653

SHA256
d7799cb82551a894fe22805cf70604c6758d663e9ede01805efa21a80288d52d

SHA512
762ae20f69c5db54870150e93481f4f97f51795a84117788d581fa8c46636a4b68b7628d4d66c932ddf57a7e6070b3fe2d822e4d01de4d83aeb86efbbc0aaf1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\d3c76a01-d5ea-4c51-9969-dc0862be0f09

Filesize
12KB

MD5
a0b8ffdf65d6dc9a7953196fb572e11b

SHA1
6143da8a4db49178b5d74083224d4626f7121e01

SHA256
7c67e4c18f465ce70240fc54a3e922dbc02493db371453dc3f4d0ab6b4591c49

SHA512
573d4bcf631b57e6953063c055db7e0197148a44018dce6047f4c957bf9582d03478ed5520a8dc295fe9365a1d5aeb027f6a5ee184733ff22f7fbab1e76b38c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
b485329f14a52cb8ee193f9e417c7f0c

SHA1
7d7b1a7c8f2e63d96676839af31edef040daa308

SHA256
16398503b83ab9c4885b65c1234336ffda8da95251c192a4ce2b2c61492719b9

SHA512
ace14145c37d53ae4f9402d984782f7e2d27032ab210f3f33f8105ef4097c9fff21e62461c889ae92397a7f88baedb7b4cb8d84a1a6d2a836cdc3dea64ffd329

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js

Filesize
6KB

MD5
0a02886cb882645369b170b24962f1b2

SHA1
9c830da43704d7df66efca2f95ef687c350b14a5

SHA256
943cdf0cf62bd70a171794266a2c759c4ddb02d8d3fe75a84edac23f55b891ac

SHA512
9b2346ded6c689d4c60c30f083b090b29ae82c6b86dac92e630a1ce3a16c6d69268445b2ab34ab21734069b4ad19f62510c08109c962ade6d727ead0e4e07ad8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js

Filesize
6KB

MD5
0403a84f895d63ee319ff77afbd7ed7c

SHA1
a09d80e9ffe2172121c140fade5600047713b7ba

SHA256
5b6bbb9d9459c0d032d09a4a732dec635379add2018104e9433ccfdd8cf31afa

SHA512
1da31316bec798a99202b7cd5887ae6682ef9050e2d9c2194cab6fe14d812e6c8f7f15b9cd993eedd0b04a05ca058551da68dfcc9ff2745196c80c727486a2e7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
613b7828989f5ee87912d71a083b7d8a

SHA1
9cd99536af6f7cc92cd8906397ab5d6e8eed3e01

SHA256
d9b6e14078c82bb1ab703455aff84e6840676a8b00798e3fd6a6835fab261f95

SHA512
99e548f3b54acc2e1f4a912c8b5cb31eac3720886a9149a120c56c325651736c0f199797a7bb633fdbf5132c157f1cecf7fef66258c3799bf65ae44010d3f39b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a58c31a25d4e64922107eea37585abbe

SHA1
85d44880a4cd6dbcc955e312e24a7f18f298e555

SHA256
1568d41e8fed8d2e776d9f0c8940f08ecc34082703783fb13d7fa25341c0a6ec

SHA512
cfefea5373db44835a4ff6960ebf4bf3ccd9daf2939027f52d46d2de3e36da8cca23602fb99f96fb9c24353eb8e7e73f815334ea2a0156a64c14e59ea7675c61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
36bfeb2a6e2d9aa04fba4f9fe45e6ae1

SHA1
81169357b70a630748b9a48ae3ff64a10c6a2c93

SHA256
040d50170f61cbcd9db2d59bba2b7c6de3012c8b29c50fc0e1969738cf346474

SHA512
7add1f13487e7433ae3edf489b0b2443eb6ebf57b808daebd95f31c9eb8d8630a93acd08f6290a1eafec888f58af357add2045bfb03ea6a8badb549c9643546b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
8e5f2ce9a4f134bb5e5bda635ce085df

SHA1
7c1f4b2a2a2e794a3042c91124395ee396d06a23

SHA256
696367ff618d28e31a49a16b365240f123bfad2f2640a884ab8225d6b7069327

SHA512
4725c845187e02c75d7df082ed08c20a67fe0f0c8db8efea32ba285876b09ff5511019051110a87c2f91979216bd7dd3d8d6d48088a7af6ff7dc7b4cc86436d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
5cd2cdefda7d393c9c614118d1c85e33

SHA1
4f892e7ae43243dcb5f175591580816648da8c92

SHA256
88fcd629c1ee88d4e4eccf6f2558e70058fa0041932242a02d20eb069454b9a7

SHA512
7558a7ca51a509a36a879471370a47e32003d8561c95f5438e32699b9efd99393cff267d6275a2657cbc3bde885c3dddbddd76f8fa52c7ce391cd123c2f83bd4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
a6138d6bf661c558560766c8c9aa5496

SHA1
81352a789515ca27f7b2b909a6f42faf704dc3db

SHA256
6ba520cdb3d3f81691da8d0d2d3442a26cc3f2294264a8070fabfa2c00b7459b

SHA512
d99d7376f441a5432f4e324156a2c98f141597d8366d212044a45f7ed6db74a34d48554b380283aea077cd8e37920f5145b47f628f8ec75461c4a347785bd829

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
e9fa8713a62a0a535b9e6fae9f3b6b7d

SHA1
29406f8b012a1699b847923de3b4ad6c88f37fb7

SHA256
6bcb4717b051587d2e9fecb1889a45a2952e52e9c512cb5fa7dd335704d1f35a

SHA512
dd0e7048014f0982f2dbeae7fea45779d7b2ba93d2c779b978a58cf49f5bc4096f8c29df4b975f890f523a4cfbab5b72439428ab91322f2330896eddba0f6e66

Download Submit
C:\Users\Admin\Downloads\Dooe7EbQ.zip.part

Filesize
125KB

MD5
b265305541dce2a140da7802442fbac4

SHA1
63d0b780954a2bc96b3a77d9a2b3369d865bf1fd

SHA256
0537fa38b88755f39df1cd774b907ec759dacab2388dc0109f4db9f0e9d191a0

SHA512
af65384f814633fe1cde8bf4a3a1a8f083c7f5f0b7f105d47f3324cd2a8c9184ccf13cb3e43b47473d52f39f4151e7a9da1e9a16868da50abb74fcbc47724282

Download Submit
memory/3336-529-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3336-519-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3364-613-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3364-587-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3364-530-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3364-660-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3364-622-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3452-670-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3452-621-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3544-583-0x0000000001FD0000-0x0000000001FDA000-memory.dmp

Filesize
40KB

Download
memory/3544-566-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-585-0x0000000001FD0000-0x0000000001FDA000-memory.dmp

Filesize
40KB

Download
memory/3544-541-0x0000000001FD0000-0x0000000001FDA000-memory.dmp

Filesize
40KB

Download
memory/3544-538-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-540-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-567-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-568-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-578-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-586-0x0000000001FD0000-0x0000000001FDA000-memory.dmp

Filesize
40KB

Download
memory/3544-542-0x0000000001FD0000-0x0000000001FDA000-memory.dmp

Filesize
40KB

Download
memory/3544-539-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-536-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3544-537-0x0000000000350000-0x000000000035A000-memory.dmp

Filesize
40KB

Download
memory/3980-620-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3980-616-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3980-615-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download