Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 12:58
Behavioral task
behavioral1
Sample
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
21 signatures
150 seconds
General
-
Target
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe
-
Size
194KB
-
MD5
b7b4c97132d03eead1fa9a9352dee6c2
-
SHA1
c9eb1bdc528076fa9c91668addf0723294ac1575
-
SHA256
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2
-
SHA512
cb0023bc6783a94a27d2d4a67c214e8657fd334d1a94a7dba51277363dee2a67e7ecc5fc0788cead1c4e0e2dc7d9aa758203f89dce162184869d20a44d171903
-
SSDEEP
3072:v6glyuxE4GsUPnliByocWepXKD0/9Wy1Og/ZK99r:v6gDBGpvEByocWehKD0/EWfg3
Malware Config
Signatures
-
Renames multiple (622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation A7C.tmp -
Deletes itself 1 IoCs
pid Process 1172 A7C.tmp -
Executes dropped EXE 1 IoCs
pid Process 1172 A7C.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3756129449-3121373848-4276368241-1000\desktop.ini 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PPj8ksf_qeowypizqysdip1rv4.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPn5r0x7lk005w7mtt_xd5b02ud.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPwz244l_5mb408ny868eliw7q.TMP printfilterpipelinesvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\te8ZzuVLn.bmp" 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\te8ZzuVLn.bmp" 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 1172 A7C.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\WallpaperStyle = "10" 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.te8ZzuVLn 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.te8ZzuVLn\ = "te8ZzuVLn" 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\te8ZzuVLn\DefaultIcon 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\te8ZzuVLn 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\te8ZzuVLn\DefaultIcon\ = "C:\\ProgramData\\te8ZzuVLn.ico" 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp 1172 A7C.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeDebugPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: 36 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeImpersonatePrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeIncBasePriorityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeIncreaseQuotaPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: 33 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeManageVolumePrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeProfSingleProcessPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeRestorePrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSystemProfilePrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeTakeOwnershipPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeShutdownPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeDebugPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeBackupPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe Token: SeSecurityPrivilege 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE 916 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1548 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 96 PID 2424 wrote to memory of 1548 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 96 PID 4232 wrote to memory of 916 4232 printfilterpipelinesvc.exe 101 PID 4232 wrote to memory of 916 4232 printfilterpipelinesvc.exe 101 PID 2424 wrote to memory of 1172 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 102 PID 2424 wrote to memory of 1172 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 102 PID 2424 wrote to memory of 1172 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 102 PID 2424 wrote to memory of 1172 2424 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe 102 PID 1172 wrote to memory of 4852 1172 A7C.tmp 103 PID 1172 wrote to memory of 4852 1172 A7C.tmp 103 PID 1172 wrote to memory of 4852 1172 A7C.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe"C:\Users\Admin\AppData\Local\Temp\1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2.exe"1⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:1548
-
-
C:\ProgramData\A7C.tmp"C:\ProgramData\A7C.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A7C.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4852
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:1756
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{3FAE0ABC-BCE0-462C-92B5-F960671B7C5E}.xps" 1337442115006500002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5e9866bb4e4409e908225719c9ab9e08b
SHA1d566a51cccad939f5ab46676eee13b28ab30bbb6
SHA256072cd0623d3e5885f4fe2a7a75fa9dcd595ce1845620acec6692f492de46693f
SHA51290ba540747d7c05df27b41d5349ac127e8ba84385c9966d326745f60949354e492cabd8524142bfe0469f60bef351323e3dd48984a40eb57fa2dee7579e2bf47
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize194KB
MD5623dfa81a5d87a1088207b7d78f85649
SHA1fdd171898c8e8dc40530202f04f0c896bfecea4b
SHA256851c080f564ca846fcec98b2d55930466ca4c1733d936ccf3e56c2ca25e42f34
SHA512d45ae0f95562af110e6a64a27906225187284c7352415c422227d3bcfd1af692e11bf72e2233e4bf6beffae033f93eb67cab639e301497262889432041c0e0eb
-
Filesize
4KB
MD505ec5200c8bc2b85a93884c0f8b2985e
SHA112bacd504e17fd9b88f3376780e00c856e71a3fc
SHA25651b957b1d8bc82b0e1fcb423e3da1c38f591d341194f10424a1f9a99d1fc8088
SHA51274a78c16a067778c65077d924681a0ca3067649c6150f581192fdfe1836cc2cc05f56c8ed05c1d5bda923ce26f015e26b6fa4c2b33359e2db0d04611e2104488
-
Filesize
4KB
MD5b484e31b5422df0344712f7fa11c765d
SHA171b6f3b19a65499d09820cf511eec39253c15b6c
SHA256e6a019b7ac9e0d3926cd25b82e658b8983476ce3c2480c26344e0e3ce805a7ec
SHA5122e081a3ff584ade0b233c05bb2ba6f795f3b6f25a2d923f4d44f81ce2013eabb170a56a0978c62970c042a9104c43d137c0af3b1e27ca4a79793fc778b1fe68a
-
Filesize
434B
MD5ad29bd8c66e114ff57c943d16c78f72a
SHA15ab070ee89a36f38facae4dfc8ec5ce3e59af46e
SHA2566fe668fe8bf69158d1fd08e90f3cff60c1df410bf752635bf152853b6112549c
SHA512a53121e2379aa9c3bc52d073498a54f26383834f6d6636b4b3831010565c80bf0da07511907eab7bd92f9796e559958b1c0ebea4c4b0f0d869e95b7deb5da7f1
-
Filesize
129B
MD5dcd481bb35318b95142e095c15702be4
SHA119fa96ae8913b0de98331863865b2333f785a11f
SHA256d9231e43df22b54559157241d1181eeeb104319b7d4dd97e85c10f918d5dff3a
SHA51216e1331c87fc6a37a511dd4adcef253253d627deb7d03d2771558dae63fa5cbe475c68071b59890c131afd841d8b0ec21ac1b1a4c7219418e755cdcf3d7df01a