Malware Analysis Report

2024-11-30 11:28

Sample ID 241119-qy359s1pbq
Target 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe
SHA256 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69
Tags
dragonforce defense_evasion discovery ransomware spyware stealer upx lockbit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69

Threat Level: Known bad

The file 82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe was found to be: Known bad.

Malicious Activity Summary

dragonforce defense_evasion discovery ransomware spyware stealer upx lockbit

DragonForce

Rule to detect Lockbit 3.0 ransomware Windows payload

Lockbit family

Dragonforce family

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Deletes itself

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Indicator Removal: File Deletion

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-19 13:41

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-19 13:41

Reported

2024-11-19 13:43

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe"

Signatures

DragonForce

ransomware dragonforce

Dragonforce family

dragonforce

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\ProgramData\F771.tmp N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\F771.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\F771.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\spool\PRINTERS\PP8cq66k48e9hk_47c7gybhbg0b.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PPsinokxr2likjupau9ml0zulcb.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP6nhdzayxyfp_2ob4tjpawlh2.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\system32\spool\PRINTERS\00002.SPL C:\Windows\splwow64.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\F771.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3992 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe C:\Windows\splwow64.exe
PID 3992 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe C:\Windows\splwow64.exe
PID 548 wrote to memory of 4780 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 548 wrote to memory of 4780 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 3992 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe C:\ProgramData\F771.tmp
PID 3992 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe C:\ProgramData\F771.tmp
PID 3992 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe C:\ProgramData\F771.tmp
PID 3992 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe C:\ProgramData\F771.tmp
PID 640 wrote to memory of 3144 N/A C:\ProgramData\F771.tmp C:\Windows\SysWOW64\cmd.exe
PID 640 wrote to memory of 3144 N/A C:\ProgramData\F771.tmp C:\Windows\SysWOW64\cmd.exe
PID 640 wrote to memory of 3144 N/A C:\ProgramData\F771.tmp C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe

"C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{A017A5B3-D693-43E8-8B2A-0390780F0449}.xps" 133764972836100000

C:\ProgramData\F771.tmp

"C:\ProgramData\F771.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\F771.tmp >> NUL

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
FR 52.109.68.129:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 129.68.109.52.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3992-0-0x00000000007C0000-0x00000000007EB000-memory.dmp

memory/3992-1-0x00000000014F0000-0x0000000001500000-memory.dmp

memory/3992-2-0x00000000014F0000-0x0000000001500000-memory.dmp

memory/3992-3-0x00000000014F0000-0x0000000001500000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\BBBBBBBBBBB

MD5 286b14012225c8fe3b34c437f4b2eb1c
SHA1 50efbc943df76d5f2dc8db98cf818e49d1e36300
SHA256 be99860b253860a23b9704a3111bd60e2a60060a27a0481989fb662f49d1ad07
SHA512 2f7029b639c2260e4e7afc87f77ada41f3a5ed706d1cbda0d64c924b61764010b116461aec7d6f40d59337874554d826882fafecfaa7f4fa1bab35da9159ec10

F:\$RECYCLE.BIN\S-1-5-21-2437139445-1151884604-3026847218-1000\DDDDDDDDDDD

MD5 55e725ab195d42b2cb71a301e7a90696
SHA1 2fad0358d2fe97dde5b0f4c85d8fd0cc5e350e24
SHA256 d718a73a918041a99ff2b1eb13e936f81929cb8785d0a529c824d7c57ad58fc2
SHA512 4ec57236b88648b9d06721089bd6b1c19a6a07ba7920605559e0ba398095ef47c57853dbd65f4b537f21c8c7342f634bbba8e9a09ccdb67f32a23d5c354ce088

C:\EUPTJQjet.README.txt

MD5 30a34a75cb209fcc9f126e7889e7c843
SHA1 131bfe55a83131f2502c3eb094984448912e53e7
SHA256 181063c7748a20cf29ec256da3f7ca4527203038e361629a2ef4ad44e2242da1
SHA512 3760c1507e224a15cac98cf116772bbc78d9c700149e90484a98c62aaeb086c23b5696d57ef41da8da7fc9b62ae0963cb030bb8205bcd5927faea62a88469de7

memory/3992-2783-0x00000000007C0000-0x00000000007EB000-memory.dmp

memory/3992-2785-0x00000000014F0000-0x0000000001500000-memory.dmp

memory/3992-2784-0x00000000014F0000-0x0000000001500000-memory.dmp

C:\ProgramData\F771.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/4780-2802-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

memory/4780-2803-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

memory/4780-2804-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH

MD5 c047e844390ac1114175ad07b3067225
SHA1 03855c87b8644f867af7b9fe37ad9a25e430a870
SHA256 1e09c27e59f0185d12dc42a50f11fe9b9e8550c095e79c92a91c6b570b3f3223
SHA512 c013b4df9ed8add3428de534c835a5731b00abe043c041d33489bfa887442c7b323aadc93807ece5add222f2568142ba1d1506aa2361db6f78604c9d9fbf7f02

memory/4780-2815-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

memory/4780-2820-0x00007FFF550B0000-0x00007FFF550C0000-memory.dmp

memory/4780-2835-0x00007FFF53020000-0x00007FFF53030000-memory.dmp

memory/4780-2836-0x00007FFF53020000-0x00007FFF53030000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{953663E8-B03C-4F95-96C0-4B181088266A}

MD5 e900c98524b9fa4c580ec0a9294a8c66
SHA1 4c32a6a9b6e56806722f5323964b28800bc58ecb
SHA256 59cf413978236a6cace3b39d0e0e4294e9de6c41147679604245db9d081bf064
SHA512 c07e52219c4daea058d02ab64c38f5899f81715481ac4507241335dd5abe0e112d226d1dd8b5708aa521f2e356db0493a128bec694726a43ec28a8b24ca05595

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-19 13:41

Reported

2024-11-19 13:43

Platform

win7-20241023-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe"

Signatures

DragonForce

ransomware dragonforce

Dragonforce family

dragonforce

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\D2AA.tmp N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\D2AA.tmp N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A

Indicator Removal: File Deletion

defense_evasion

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\D2AA.tmp N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe

"C:\Users\Admin\AppData\Local\Temp\82b336cd120ef07d8df5a3e3fa082bcca8b5c0a3481fae78cb5dd29072979f69(1).exe"

C:\ProgramData\D2AA.tmp

"C:\ProgramData\D2AA.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D2AA.tmp >> NUL

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x150

Network

N/A

Files

memory/1956-0-0x0000000001120000-0x000000000114B000-memory.dmp

memory/1956-1-0x00000000001C0000-0x0000000000200000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini

MD5 b2789969ee5c57c2ee4c2c8a8d9718ae
SHA1 65b3339698468acb23e2d1a2a5d4466b7c83962a
SHA256 f5ab4af8d14f0c279b80bbae186ea2ba731885ae848abd7bbee0c856eb63d772
SHA512 dba669a606e75aa4184e0afeb49d8030d6b4c4c6968789d62036fe795a3e7a49c3410e0f975a923ba537c2675e8fcb3884d1950fa7fabffa4226caccf35e289e

C:\EUPTJQjet.README.txt

MD5 7bf858ed0cdf9de3b68d3c26a99e09bd
SHA1 6e3acd29065e409b8be7cf3b16f1754af10681f5
SHA256 74b0370b673fb6e5a2976150b75c7da4ce85a197f25aa86494b8d0c01594b0bb
SHA512 967217b8269cc9cb4c723d3a62ef9ac68c1cb964f4473a56ec9fbf0f057cbee2215988bc9bf0a15f45547e1f163f0b5fcf6aa05b2d89d60af41359bb66ea3b8b

F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\DDDDDDDDDDD

MD5 aa9a5109fdc5b6f32175289b9369cadf
SHA1 86c0827812d5b82c3b2fd8edce35eb41c1c48e36
SHA256 5528d53702506bfcebb8598c28b1d609de1632b15f54c59da41aa23b070a984b
SHA512 b3c8508660ed6328c7105a0afe99674b17187febdae6aea6fe47545e6e948972044a4cee1669e6d3e5f8f13572245e621b9f602366062a8fce5aa7ae4fe1bc6c

\ProgramData\D2AA.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/1956-876-0x0000000001120000-0x000000000114B000-memory.dmp

memory/2088-875-0x000000007EF20000-0x000000007EF21000-memory.dmp

memory/2088-874-0x000000007EF80000-0x000000007EF81000-memory.dmp

memory/2088-873-0x00000000003C0000-0x0000000000400000-memory.dmp

memory/2088-872-0x00000000003C0000-0x0000000000400000-memory.dmp

memory/2088-871-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 98f202bf6424228b2192e7ce8bc9d953
SHA1 5795dd53118c5dc789d2662e3ec153664b45d738
SHA256 c818eec1ab2f3a17980a963a9e6efe14cb0dd727a15ed5aeb1cfeca93fde7f39
SHA512 ebb6db7cf2b471896ac3bb11ab8d239b0842a01b239a59ebd071452b54481a4dd0e44e66ac12ecd4701eaf48718cb755648b7e34c2745dd7d7122c29b402595d

memory/2088-906-0x000000007EF60000-0x000000007EF61000-memory.dmp

memory/2088-905-0x000000007EF40000-0x000000007EF41000-memory.dmp