Analysis
-
max time kernel
92s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 13:41
Behavioral task
behavioral1
Sample
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe
Resource
win7-20241023-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe
Resource
win10v2004-20241007-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe
-
Size
90KB
-
MD5
6c755a742f2b2e5c1820f57d0338365f
-
SHA1
0b22b6e5269ec241b82450a7e65009685a3010fb
-
SHA256
82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69
-
SHA512
580fec443cb3236201750e643078b98e3d9f46cad3cc890b74371119f0ec33a0c5ba526e6135cc1ddcb90d867c214e37c700af55309c7725ed44e100173630ed
-
SSDEEP
1536:yvXFnGvewvD/F3nICjRM5CEL92vR2zh9ckMBsA1RXZN1Mevt5:Ow3FE79UUzh9mBjBZNe
Malware Config
Extracted
Path
C:\EUPTJQjet.README.txt
Family
dragonforce
Ransom Note
Hello!
Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.
--- Our communication process:
1. You contact us.
2. We send you a list of files that were stolen.
3. We decrypt 1 file to confirm that our decryptor works.
4. We agree on the amount, which must be paid using BTC.
5. We delete your files, we give you a decryptor.
6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
>>> Use this ID: 39C1BACACEDFEC0FA03BA23721E93627 to begin the recovery process.
* In order to access the site, you will need Tor Browser,
you can download it from this link: https://www.torproject.org/
--- Additional contacts:
Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20
--- Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
--- Important:
If you refuse to pay or do not get in touch with us, we start publishing your files.
26/04/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Signatures
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation F771.tmp -
Deletes itself 1 IoCs
pid Process 640 F771.tmp -
Executes dropped EXE 1 IoCs
pid Process 640 F771.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\spool\PRINTERS\PP8cq66k48e9hk_47c7gybhbg0b.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPsinokxr2likjupau9ml0zulcb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PP6nhdzayxyfp_2ob4tjpawlh2.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 640 F771.tmp -
resource yara_rule behavioral2/memory/3992-0-0x00000000007C0000-0x00000000007EB000-memory.dmp upx behavioral2/memory/3992-2783-0x00000000007C0000-0x00000000007EB000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp 640 F771.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeDebugPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: 36 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeImpersonatePrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeIncBasePriorityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeIncreaseQuotaPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: 33 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeManageVolumePrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeProfSingleProcessPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeRestorePrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSystemProfilePrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeTakeOwnershipPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeShutdownPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeDebugPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeBackupPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe Token: SeSecurityPrivilege 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE 4780 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3992 wrote to memory of 916 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 94 PID 3992 wrote to memory of 916 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 94 PID 548 wrote to memory of 4780 548 printfilterpipelinesvc.exe 102 PID 548 wrote to memory of 4780 548 printfilterpipelinesvc.exe 102 PID 3992 wrote to memory of 640 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 103 PID 3992 wrote to memory of 640 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 103 PID 3992 wrote to memory of 640 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 103 PID 3992 wrote to memory of 640 3992 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe 103 PID 640 wrote to memory of 3144 640 F771.tmp 104 PID 640 wrote to memory of 3144 640 F771.tmp 104 PID 640 wrote to memory of 3144 640 F771.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe"C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:916
-
-
C:\ProgramData\F771.tmp"C:\ProgramData\F771.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F771.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:3144
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:2636
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{A017A5B3-D693-43E8-8B2A-0390780F0449}.xps" 1337649728361000002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5286b14012225c8fe3b34c437f4b2eb1c
SHA150efbc943df76d5f2dc8db98cf818e49d1e36300
SHA256be99860b253860a23b9704a3111bd60e2a60060a27a0481989fb662f49d1ad07
SHA5122f7029b639c2260e4e7afc87f77ada41f3a5ed706d1cbda0d64c924b61764010b116461aec7d6f40d59337874554d826882fafecfaa7f4fa1bab35da9159ec10
-
Filesize
1KB
MD530a34a75cb209fcc9f126e7889e7c843
SHA1131bfe55a83131f2502c3eb094984448912e53e7
SHA256181063c7748a20cf29ec256da3f7ca4527203038e361629a2ef4ad44e2242da1
SHA5123760c1507e224a15cac98cf116772bbc78d9c700149e90484a98c62aaeb086c23b5696d57ef41da8da7fc9b62ae0963cb030bb8205bcd5927faea62a88469de7
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH
Filesize90KB
MD5c047e844390ac1114175ad07b3067225
SHA103855c87b8644f867af7b9fe37ad9a25e430a870
SHA2561e09c27e59f0185d12dc42a50f11fe9b9e8550c095e79c92a91c6b570b3f3223
SHA512c013b4df9ed8add3428de534c835a5731b00abe043c041d33489bfa887442c7b323aadc93807ece5add222f2568142ba1d1506aa2361db6f78604c9d9fbf7f02
-
Filesize
4KB
MD5e900c98524b9fa4c580ec0a9294a8c66
SHA14c32a6a9b6e56806722f5323964b28800bc58ecb
SHA25659cf413978236a6cace3b39d0e0e4294e9de6c41147679604245db9d081bf064
SHA512c07e52219c4daea058d02ab64c38f5899f81715481ac4507241335dd5abe0e112d226d1dd8b5708aa521f2e356db0493a128bec694726a43ec28a8b24ca05595
-
Filesize
129B
MD555e725ab195d42b2cb71a301e7a90696
SHA12fad0358d2fe97dde5b0f4c85d8fd0cc5e350e24
SHA256d718a73a918041a99ff2b1eb13e936f81929cb8785d0a529c824d7c57ad58fc2
SHA5124ec57236b88648b9d06721089bd6b1c19a6a07ba7920605559e0ba398095ef47c57853dbd65f4b537f21c8c7342f634bbba8e9a09ccdb67f32a23d5c354ce088