Analysis
-
max time kernel
92s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 13:41
Behavioral task
behavioral1
Sample
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe
-
Size
147KB
-
MD5
3c311cabe7de6a8c104f8f10541d392d
-
SHA1
f59f4be06c9d1a94d44d1f6a6afd4ad6d532cb47
-
SHA256
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4
-
SHA512
4fe621de344f25f4d0b6bc557afb392e2d6976f930bfe96a425dc619e7641387dfb356314d455676860f05af1de35a10a57d1d746b41e0317865703ed11fb77a
-
SSDEEP
3072:U6glyuxE4GsUPnliByocWepPaEYLUTcVWH0XUQx4b:U6gDBGpvEByocWeHYLULUXUQ
Malware Config
Extracted
Path
C:\EUPTJQjet.README.txt
Family
dragonforce
Ransom Note
Hello!
Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay.
--- Our communication process:
1. You contact us.
2. We send you a list of files that were stolen.
3. We decrypt 1 file to confirm that our decryptor works.
4. We agree on the amount, which must be paid using BTC.
5. We delete your files, we give you a decryptor.
6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
--- Client area (use this site to contact us):
Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
>>> Use this ID: 39C1BACACEDFEC0F53F667B80650E866 to begin the recovery process.
* In order to access the site, you will need Tor Browser,
you can download it from this link: https://www.torproject.org/
--- Additional contacts:
Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20
--- Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
--- Important:
If you refuse to pay or do not get in touch with us, we start publishing your files.
26/04/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs
http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
Signatures
-
DragonForce
Ransomware family based on Lockbit that was first observed in November 2023.
-
Dragonforce family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AFD8.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation AFD8.tmp -
Deletes itself 1 IoCs
Processes:
AFD8.tmppid Process 1076 AFD8.tmp -
Executes dropped EXE 1 IoCs
Processes:
AFD8.tmppid Process 1076 AFD8.tmp -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
Processes:
printfilterpipelinesvc.exesplwow64.exedescription ioc Process File created C:\Windows\system32\spool\PRINTERS\PPg32c8loprf2s23wam7i_2k9sb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPw9dm8372258qg2a1t0ups9_2d.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\00002.SPL splwow64.exe File created C:\Windows\system32\spool\PRINTERS\PPv_b8nft0aew43z_pzawt0dak.TMP printfilterpipelinesvc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exeAFD8.tmppid Process 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 1076 AFD8.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exeAFD8.tmpcmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ONENOTE.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
ONENOTE.EXEdescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily ONENOTE.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ONENOTE.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exepid Process 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
AFD8.tmppid Process 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp 1076 AFD8.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeDebugPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: 36 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeImpersonatePrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeIncBasePriorityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeIncreaseQuotaPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: 33 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeManageVolumePrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeProfSingleProcessPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeRestorePrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSystemProfilePrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeTakeOwnershipPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeShutdownPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeDebugPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeBackupPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe Token: SeSecurityPrivilege 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
ONENOTE.EXEpid Process 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE 3764 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exeprintfilterpipelinesvc.exeAFD8.tmpdescription pid Process procid_target PID 448 wrote to memory of 4848 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 92 PID 448 wrote to memory of 4848 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 92 PID 448 wrote to memory of 1076 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 97 PID 448 wrote to memory of 1076 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 97 PID 448 wrote to memory of 1076 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 97 PID 448 wrote to memory of 1076 448 88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe 97 PID 3732 wrote to memory of 3764 3732 printfilterpipelinesvc.exe 98 PID 3732 wrote to memory of 3764 3732 printfilterpipelinesvc.exe 98 PID 1076 wrote to memory of 4780 1076 AFD8.tmp 99 PID 1076 wrote to memory of 4780 1076 AFD8.tmp 99 PID 1076 wrote to memory of 4780 1076 AFD8.tmp 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"C:\Users\Admin\AppData\Local\Temp\88169b1d4778ed6c5fda97375efb5b9171ea52649c8715bb449801c39bce4ad4.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
- Drops file in System32 directory
PID:4848
-
-
C:\ProgramData\AFD8.tmp"C:\ProgramData\AFD8.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AFD8.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:4780
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:3028
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{7CC11971-551F-4A92-A048-D0E26A37BE42}.xps" 1337649727760900002⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD50ad6b3253f71fd4134054f6db5548a50
SHA1b9c5ec1a5fe1ccd8e67c626422b40a57e2272d2f
SHA2568f7865596e1f491015aae748d4559d388d9247ca6baf09bca8e2ba453e583271
SHA512d3738be57f4d830cdd6f3b07022c5a63b0cf3474527ea46936d35943729191c744d17e117b4d04c2b0c1460abc45c0680b8d78be1601a2c7bd8efea534dad537
-
Filesize
1KB
MD56e7518f51594ee064a86a4003f0f0345
SHA1ecffead1e3d310d36c7b8c00ebd7bba61bcacb0a
SHA256dab5c2feb87aa201be58d3652f0933d39e423a5b8edfe9824521c01a68f6b6d3
SHA51243f4c78c0cfb8ce806ddf910324603ad04d5990be28d407ef5138d25515bbdae03e759fc550a330f1efb950e1259608f35ae08d4cc263727f19aba9c64693823
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize147KB
MD52743b066f6a79529f1bffdc2ce276c92
SHA160269b421af361e433278aa9e9350e43293f3fa2
SHA2568fb45dbd1521c2fe7732afd197c2343c850e3a65978bb870468d916c25aefdea
SHA51231d875bc8785f674b83db453e73d4171073bc66ea611f2314c31eac2a2d955cd43d5a038a7fc18c9314505d1156085debb39ae89f11410968df27b4a7e7a771d
-
Filesize
4KB
MD532708012e991bf7ae117dc4bf3bd7c4e
SHA17f3a85ecf6e29a8d9b756a172d1a71b23808bcfc
SHA25681b7a4450fce23dd64e65bddce66380698cca9f6733ec7f9346514320c214013
SHA51279a72fd45a9f8289146cb1d210de48fd489d269ab4c93c2ead002d035a166acbe908c3057714cd21476f3944f1408dd6afbac69e423dbf83277944fe5f95e8b9
-
Filesize
129B
MD52be82da7dd207495b7db93f84e9f0210
SHA1fbb33def7c322d791203456ea5d5d598438cbebd
SHA256392b681b70e0226c356caec8fdc362a38f64e7fc0e49d616a04fb83b95a2e57c
SHA5127f0b94a070c163e8db0c66018c0d24d7b57bd2ccd5c5c518815f30757594ec6d7e7831a8fab5e1e7e06139819e2d572a14c4cb5986ae262e9afb58e33a8c30c6