Analysis
-
max time kernel
60s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 19:51
Behavioral task
behavioral1
Sample
f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
60 seconds
Behavioral task
behavioral2
Sample
f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
60 seconds
General
-
Target
f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
-
Size
145KB
-
MD5
9c70caed1f0c37a7d891f22f5e6ac297
-
SHA1
8a1f61df4627065a5977033b42654fb4ec85be19
-
SHA256
f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2
-
SHA512
c54a137cb0439a1cd8040f3e12e0f6dbcfedb99db2135d66e7d6667a0298bc920118c909a5545555425df8149ac1fe321fb1e4bf43a2782831dfbc2ca42de645
-
SSDEEP
3072:DqJogYkcSNm9V7DjWWumrIDNd7k/PHm2T:Dq2kc4m9tDaWumrIDNm/u
Score
9/10
Malware Config
Signatures
-
Renames multiple (4144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.LobUbwGIO f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.LobUbwGIO\ = "LobUbwGIO" f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LobUbwGIO\DefaultIcon f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LobUbwGIO f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LobUbwGIO\DefaultIcon\ = "C:\\ProgramData\\LobUbwGIO.ico" f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeDebugPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: 36 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeImpersonatePrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeIncBasePriorityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeIncreaseQuotaPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: 33 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeManageVolumePrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeProfSingleProcessPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeRestorePrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSystemProfilePrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeTakeOwnershipPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeShutdownPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeDebugPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeBackupPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe Token: SeSecurityPrivilege 2980 f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe"C:\Users\Admin\AppData\Local\Temp\f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe"1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55f6cc48c9a2c962b9767093f80a31b88
SHA16e6af2b3a0f7e479fa9560c6a5d42d9b55eae982
SHA256bdb6415b07b2e12ca9b556433f975e07829f8274bed95daa4727f96d093402cf
SHA5126b10f2cdb5aa4d9553fe58c3c3c664ebcd4413acc16265ef6b3d626f44c5027629f8ed8d7b5a51d47fb240d455eaa84ba4b7199a2b3e5319ed3c0765512aabb0
-
Filesize
129B
MD583781f5d3c2091c9467f064860856587
SHA17877b8029f727c11901f439365c6b47f896a2dd8
SHA256c0562f3d18ea7fab94861201134cb656ccb16f049c267ea1173298d9d9867f2d
SHA512124bf23222e550033631e4b2b155f111f4096127567d5b178ad35e6a042c47141410538661391de7766b05f4a9152fdba8eab8ebb50c57eec3e5e20598ff7256