f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2

General

Target

f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Size

145KB
MD5

9c70caed1f0c37a7d891f22f5e6ac297
SHA1

8a1f61df4627065a5977033b42654fb4ec85be19
SHA256

f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2
SHA512

c54a137cb0439a1cd8040f3e12e0f6dbcfedb99db2135d66e7d6667a0298bc920118c909a5545555425df8149ac1fe321fb1e4bf43a2782831dfbc2ca42de645
SSDEEP

3072:DqJogYkcSNm9V7DjWWumrIDNd7k/PHm2T:Dq2kc4m9tDaWumrIDNm/u

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (4144) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 2 IoCs

Processes:

f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

description	ioc	process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

Modifies registry class 5 IoCs

Processes:

f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.LobUbwGIO	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.LobUbwGIO\ = "LobUbwGIO"	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LobUbwGIO\DefaultIcon	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LobUbwGIO	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LobUbwGIO\DefaultIcon\ = "C:\\ProgramData\\LobUbwGIO.ico"	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

Processes:

f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

pid	process
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeDebugPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: 36	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeImpersonatePrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeIncBasePriorityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeIncreaseQuotaPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: 33	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeManageVolumePrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeProfSingleProcessPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeRestorePrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSystemProfilePrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeTakeOwnershipPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeShutdownPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeDebugPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeBackupPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
Token: SeSecurityPrivilege	2980	f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe

C:\Users\Admin\AppData\Local\Temp\f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe
"C:\Users\Admin\AppData\Local\Temp\f16db77670d11d7884a9814e5212038b618ee9ab573345353e9b5fc9e438a2c2.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\MMMMMMMMMMM

Filesize
129B

MD5
5f6cc48c9a2c962b9767093f80a31b88

SHA1
6e6af2b3a0f7e479fa9560c6a5d42d9b55eae982

SHA256
bdb6415b07b2e12ca9b556433f975e07829f8274bed95daa4727f96d093402cf

SHA512
6b10f2cdb5aa4d9553fe58c3c3c664ebcd4413acc16265ef6b3d626f44c5027629f8ed8d7b5a51d47fb240d455eaa84ba4b7199a2b3e5319ed3c0765512aabb0

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-457978338-2990298471-2379561640-1000\DDDDDDDDDDD

Filesize
129B

MD5
83781f5d3c2091c9467f064860856587

SHA1
7877b8029f727c11901f439365c6b47f896a2dd8

SHA256
c0562f3d18ea7fab94861201134cb656ccb16f049c267ea1173298d9d9867f2d

SHA512
124bf23222e550033631e4b2b155f111f4096127567d5b178ad35e6a042c47141410538661391de7766b05f4a9152fdba8eab8ebb50c57eec3e5e20598ff7256

Download Submit
memory/2980-0-0x0000000000470000-0x00000000004B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads