Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2024 18:01
Behavioral task
behavioral1
Sample
202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe
-
Size
146KB
-
MD5
7e289e2de04d519e94419ccdc5e9fb0c
-
SHA1
3a868a8b93da54dcc18f47f67a322a5ab0aa0178
-
SHA256
c1f9a88541f2175dbe7ac071fa8219e1df77fc7b0efd74c116757b5968ba3405
-
SHA512
a69d8d4c4875442a2d4c07b887fb47a57eb8f9f1be9fe2720d121460f3684334c44ad64da4f24344e5054603dd7e55ca59996ae86f96598de842d9407e826b39
-
SSDEEP
3072:E6glyuxE4GsUPnliByocWep+n9l4Tu3c65QBO5:E6gDBGpvEByocWekn9lY65p5
Malware Config
Signatures
-
Renames multiple (641) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation F955.tmp -
Deletes itself 1 IoCs
pid Process 4396 F955.tmp -
Executes dropped EXE 1 IoCs
pid Process 4396 F955.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PP23k3iq_95ia8lanrl225wp9cd.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PP0hdzz6_x0z75sno63d8z4vyw.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPje0qdbqg7nf69lvu7dil3396b.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\HphEJKWIi.bmp" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\HphEJKWIi.bmp" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 4396 F955.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F955.tmp -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\WallpaperStyle = "10" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HphEJKWIi 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HphEJKWIi\DefaultIcon\ = "C:\\ProgramData\\HphEJKWIi.ico" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.HphEJKWIi 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.HphEJKWIi\ = "HphEJKWIi" 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HphEJKWIi\DefaultIcon 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp 4396 F955.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeDebugPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: 36 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeImpersonatePrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeIncBasePriorityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeIncreaseQuotaPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: 33 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeManageVolumePrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeProfSingleProcessPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeRestorePrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSystemProfilePrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeTakeOwnershipPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeShutdownPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeDebugPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeBackupPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe Token: SeSecurityPrivilege 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE 5040 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2968 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 88 PID 1088 wrote to memory of 2968 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 88 PID 2140 wrote to memory of 5040 2140 printfilterpipelinesvc.exe 93 PID 2140 wrote to memory of 5040 2140 printfilterpipelinesvc.exe 93 PID 1088 wrote to memory of 4396 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 94 PID 1088 wrote to memory of 4396 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 94 PID 1088 wrote to memory of 4396 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 94 PID 1088 wrote to memory of 4396 1088 202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe 94 PID 4396 wrote to memory of 4320 4396 F955.tmp 95 PID 4396 wrote to memory of 4320 4396 F955.tmp 95 PID 4396 wrote to memory of 4320 4396 F955.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe"C:\Users\Admin\AppData\Local\Temp\202409167e289e2de04d519e94419ccdc5e9fb0cdarkside.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:2968
-
-
C:\ProgramData\F955.tmp"C:\ProgramData\F955.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F955.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4320
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2672
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C3A78A6C-3E36-4D8B-AC73-30CAF7810A89}.xps" 1337098332262500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:5040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD57d354003e8c93edd76daea889681d753
SHA14d673c0f65ca4efeeeacc23d9cae9479afe13e60
SHA25693cefbfbf2c5b1f725d7c3ea8cb5a60cddd8066352eace47f0cd8e84b3044fc5
SHA512fef9c3b29cf154923002d488fd3a53bc2f19aff6d98b69165a2d789c54354a6cf7b03ac0d017a72d507f478f467130664373b95e26a14ab56bea6abb97928d70
-
Filesize
343B
MD572b1ffaeb7de456483f491ecceadb088
SHA1ee1953abc295245ab01f35a4a823883826bf2b41
SHA256eb892eac9899b995047733bb17acd4945eb42b7b49f2ee8ad52b8026bc0297a7
SHA512c0e7cad617cf1490bb25fc47936edc3ae164b190ed34f2d2a50e7e84ce6e0d6712a6ba9ab351cca1589266078326a00317516c53fecf96f20eaefe15e92ce445
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
146KB
MD518cc96c9170d931857a169d83179f55d
SHA15a83f808f9e38228daa3e74148401dd4b6f712ee
SHA256de0ced8dd5a5f488e2ae2db2b1401167964f61d5ca30040f5a77b3ede035b789
SHA512a17009e1500b779cbd5cb7e04363d467fed1e0a6b1c2b76eb15d3c54cc5a71406d7f2e80e7b8cbc6638e6f10bf07b4b52d5e7d004cc4a712fc6c04925f92960c
-
Filesize
4KB
MD501387999d565d0bf7a791315b294fe56
SHA129c6c554e61da680f786975b7b50968833be6645
SHA256618786f3828bb71b946db9966aa17b0fe84c34297cb2fd6cbd70a96341752c59
SHA512f73694a19de2fd7be1565a44ed9b397b3fe4043c5cf506926404543f9ba5e8f5c84c73f08512dc71074865231dce214e6c94deb95e4f0832b705129051cc535e
-
Filesize
4KB
MD5e3c26329ab07aceb01a41455213cfcf7
SHA13e4bdc04951c5dfb93c4515b92e9a23c74f7105d
SHA256338573e3fc7b20082cf2e170faae85c0c77437f21d0b7d3fd5c3e650e9ac7324
SHA5125ece33860291fd3300f7b7da4a6cff8af62f55e70eb658f423f4ee38631b565193048ee5cd8ec31bf53a940b314069ba119966a5481f0f20b3375c84db3c266e
-
Filesize
129B
MD5ee64458b6a576dc6a23a548f490f3434
SHA18b4692f3f5e51ce9590630ea9c2d918a2c280b9f
SHA256494ee49c5038eeaf210fa67ef7708c912d7bcd51701ab47acacbd8a2d440ec15
SHA512b0b7a7be633736aee73fcda39e62d45dac7b5bb5f2dac3a11a63a198918314f0d19a7baf09c80638348bbcc0540db3b14208fc3994aa1ef89ad2398043d91d74